last executing test programs: 3m49.638602769s ago: executing program 0 (id=2104): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="38010000100001002cbd700000010000fe880000000000000000000000000001fe880000000000000000000000000001000100004e2200000200000021000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000be248c02000000000000000000000000000000009201000000000000060000000000000002000100000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001e00000000000000feffffffffffffff02000000fcffffff000000002abd"], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) 3m49.358267676s ago: executing program 0 (id=2105): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_ALLOW_SUSPEND(0xffffffffffffffff, 0x5522) write(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x1ba) capset(&(0x7f0000000080)={0x20080522}, 0x0) syz_open_dev$midi(&(0x7f00000000c0), 0x100000000, 0x10880) mount$9p_tcp(&(0x7f0000000200), &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x4000, &(0x7f0000000340)={'trans=tcp,', {'port', 0x3d, 0x4e24}, 0x2c, {[{@privport}]}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0100000007000000612200000200000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=r5], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r6, &(0x7f0000000000), &(0x7f0000000080)=@udp}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r6, &(0x7f00000001c0), &(0x7f0000000040)=@tcp6, 0x2}, 0x20) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000140)={0x0, 0x2, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d80672e65a6a0a72e19c2b60bd6276fd8bb6366e9d1ed9a60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d10d1f600"}) ioctl$USBDEVFS_ALLOW_SUSPEND(r3, 0x5522) ioctl$USBDEVFS_SETINTERFACE(r3, 0x80045510, &(0x7f0000000040)={0x0, 0x200000}) 3m48.411009059s ago: executing program 0 (id=2107): openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x4000000004882, 0x0) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r0, 0x0, 0x0) 3m47.482455622s ago: executing program 0 (id=2109): syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f00000005c0)='./file0\x00', 0x1008002, &(0x7f00000000c0)={[{@orlov}, {@errors_remount}]}, 0x3, 0x5eb, &(0x7f0000000c00)="$eJzs3ctvFEcaAPCvxw9sjNYDWu0ue1gsrVYg7WJjAysU5QDXCFnkoVxyiYMNIRiwsKPEJBJGIpdIUS5RFCmnHEL+iwSFK6fklEMuOUVIKIk4RspEPdNtPHaPX9jTiP79pGG6q6Zd1djfVHVNVU8AlTWS/lOLOBgRc0nEcLK0nNcbWeZI63WPfnv/fPpIotF4+Zckkiwtf32SPQ9lBw9ExHffJnGgZ22584s3Lk/Nzs5cz/bHFq7Mjc0v3jh66crUxZmLM1cn/j9x6uSJk6fGj23rvG4WpJ29/dY7wx9Ovvbl578n41/9OJnE6Xghe+HK89gpIzHS/D9J1mYNndrpwkrSk/2dNBqNRp6W9JZbJzYv//31RcTfYzh64vEvbzg+eLHUygG7qpG03ruBKkrEP1RU3g/Ir+1XXwfXSumVAN3w8ExrAGBt/Pe2xgZjoDk2sPdREiuHdZKI2N7IXLt9EXH/3uTtC/cmb8cujcMBxZZuRcQ/iuI/acZ/PQai3oz/Wlv8p/2Cc9lzmv7SNstfPVQs/qF7WvE/sG78R4f4fz19vtmK4Te2WX798eabg23xP7jdUwIAAAAAAIDKunsmIv5X9Pl/bXn+TxTM/xmKiNM7UP7Iqv21n//XHuxAMUCBh2cini+c/1vLZ//We1YsYa1HX3Lh0uzMsYj4S0Qcib496f74OmUc/ejAZ53yRrL5f/kjLf9+Nhcwq8eD3j3tx0xPLUw9wSkDmYe3Iv5ZOP83WW7/k4L2P31nmNtkGQf+c+dcp7yN4x/YLY0vIg4Xtv+P71qRrH9/jrFmf2As7xWs9a/3Pv66U/nbjX+3mIAnl7b/e9eP/3qy8n4981sv4/hib6NT3nb7//3JK827CvVnae9OLSxcH4/oT872pKlt6RNbrzM8i/J4yOMljf8j/15//K+o/z8YEUurfnbya/ua4tzf/hj6qVN99P+hPGn8T2+p/d/6xsSd+jedyt9c+3+i2dYfyVKM/0HLp3mY9renF4Rjb1FWt+sLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM+CWkTsi6Q2urxdq42ORgxFxF9jb2322vzCfy9ce/vqdJrX/P7/Wv5Nv8Ot/ST//v/6iv2JVfvHI2J/RHzSM9jcHz1/bXa67JMHAAAAAAAAAAAAAAAAAACAp8RQh/X/qZ97yq4dsOt6y64AUJqC+P++jHoA3af9h+oS/1Bd4h+qS/xDdYl/qC7xD9Ul/qG6xD8AAAAAADxT9h+6+0MSEUvPDTYfqf4sr6/UmgG7rVZ2BYDSuMUPVJepP1BdrvGBZIP8gY4HbXTkeubOP8HBAAAAAAAAAAAAAFA5hw9a/w9VZf0/VJf1/1Bd+fr/QyXXA+g+1/hAbLCSv3D9/4ZHAQAAAAAAAAAAAAA7aX7xxuWp2dmZ6zZefTqq0c2NRqNxM/0reFrqs/MbSTZDvSuF5lPhu3+m/Zs5wXyt3+Z+cnnvSQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQLs/AwAA//+JjCTl") mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) rename(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 3m45.164796099s ago: executing program 0 (id=2120): syz_emit_ethernet(0x4a, 0x0, 0x0) prlimit64(0x0, 0x2, &(0x7f0000000040)={0xfffffffffffffffc, 0xffffffffffffffff}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000640)={'\x00', 0x100, 0x1, 0x2, 0xc, 0x5, 0xffffffffffffffff}) prlimit64(r0, 0xe, &(0x7f0000000140)={0x7, 0x103}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) socket(0x2, 0x3, 0xff) clock_getres(0x6, 0x0) syz_emit_vhci(0x0, 0x18) brk(0x5d555ede6000) syz_clone(0xd8024a00, &(0x7f0000000080)="6ff7a4f4232d73565a09c11ecbad662bf0a28b", 0x13, 0x0, &(0x7f0000000400), 0x0) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x80, &(0x7f0000000c40)=ANY=[], 0x1, 0x196, &(0x7f0000000200)="$eJzsmLFPwkAUxr+7YhuNg64uDhLFwdIWNS7EuDmaiBo3CVSCFjHAIEy6+H84Ozj7fxhndTAujm4mNdcecIhH1JhI9P2G53d9767vnuEbCoIg/i0P9y93q7lbLvQ4krDk8yejW8OV+teb80J9cj17OfuYvbaqV+/PYwDC8PPvZzB71mHYuzsp/+bAO3oLHPNS74DBlnoPHNtS+2DYlfpA0VVRb9v75cC3C9WgKIQjgiuCJ0JGfX8CwPMZQ1Hpjyn5erN1mA8Cv6YRlj6lE2IgPU8GzS/qb40jq/Sn/r/as3GU+bngcKXOgGFT6hVY7dnEI1HuP5Xonm984f5/TxjD0QaJXxFg39gF4LQvhYn4FzQc9/p50fWn8IJhTvGnhOIf6UblOF1vthbKlXzJL/lHnpdZdhYdZ8lLR0YUxwH+Nxr505hy/oim1mQmTvKNRs2NY2ftxfEjx+WR/3GkZuK18H5T202cZ3Ifi1TKGFBOEARBEARBEARBEARBEAShpf9b5DRY9BVUA2TS24iq3wIAAP//gjdrMQ==") socket$nl_route(0x10, 0x3, 0x0) 3m44.174913674s ago: executing program 0 (id=2126): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x34000004}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 3m43.203904977s ago: executing program 32 (id=2126): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x9, 0x4, 0xb47e, 0xb, 0x3, 0xd, 0xf, 0x1ff}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x34000004}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 8.59798314s ago: executing program 4 (id=2594): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000240)={@hyper, 0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, &(0x7f0000000080)={{@hyper, 0x2}, @any, 0x0, 0x7fff, 0x2, 0x6, 0x9a6, 0x8000, 0x8}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000400)={&(0x7f000000c300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) socket$inet6_tcp(0xa, 0x1, 0x0) 7.590426005s ago: executing program 1 (id=2596): r0 = syz_open_dev$ndb(&(0x7f0000000280), 0x0, 0x61c7c039d0921a4e) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, 0x0, 0x440b0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) waitid(0x2, r4, 0x0, 0x4, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0xe07e872420dfefca) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfdef) ioctl(0xffffffffffffffff, 0xc138fd04, &(0x7f0000000000)) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x3000000}, 0x50) r5 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0xa5) write$RDMA_USER_CM_CMD_GET_EVENT(r5, &(0x7f0000000480)={0xc, 0x8, 0xfa00, {0x0}}, 0x10) ioctl$NBD_DO_IT(r0, 0xab03) mount$9p_xen(0x0, 0x0, 0x0, 0x8005, 0x0) 7.543925675s ago: executing program 4 (id=2598): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000240)={@hyper, 0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, &(0x7f0000000080)={{@hyper, 0x2}, @any, 0x0, 0x7fff, 0x2, 0x6, 0x9a6, 0x8000, 0x8}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000400)={&(0x7f000000c300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWFLOWTABLE={0x60, 0x16, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'netdevsim0\x00'}]}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x88}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) socket$inet6_tcp(0xa, 0x1, 0x0) 7.36993321s ago: executing program 2 (id=2599): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') r1 = add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, 0x0) sendmmsg$inet(r2, &(0x7f00000028c0), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) close(r2) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c9"], 0x16) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1}, &(0x7f0000000240)=""/186, 0xba, &(0x7f0000000440)={0x0, &(0x7f00000003c0)="a72f976605f2c4f756fda55f7fbb8ae19a80bc96c1c7c487736029646cce7944d346c750dc2eeafc1ac58789b5f2755f2355d0ef497159302cd549c8e27b05f63d5d2121", 0x44}) 5.229002792s ago: executing program 4 (id=2601): syz_mount_image$ocfs2(&(0x7f0000004440), &(0x7f0000000040)='./file1\x00', 0x200840, &(0x7f0000000600)=ANY=[@ANYBLOB="61636c2c6865617274626561743d6e6f6e652c6469725f726573765f6c6576656c3d30303030303030303030303030303030303030332c726573765f6c6576656c3d30303030303030303030303030303030303030362c636f686572656e63793d66756c6c2c6c6f63616c666c6f636b732c636f686572656e63793d66756c6c2c6e6f61636c2c004c98065b85e5b137d63b2211c62c402045083da9bddc3b0d88d44ecd24ba5288d428197284f332858b83349af2c7646f1e07e91120d7f23ce20389bbc031d81d654f1ca08f61c92d90e6ea478843c1ad942c7c257f9ff5348dd038e947775991ad90f8861dada21d5fa2de7042b5e2cbbcd1ada2b568e375812eb0bc448e68eda4c70cf1d5adf566142ed45924fe72a1eb1a914faf754b9d94bf0fdc1f98c708bd89940b5ef96e328240c39559b35bc83c15c15104f3b3fe1945f0278c34e2399dadcd9776ac659afcbb239569140ab408ad87f15b353941"], 0x5, 0x4445, &(0x7f000000cd00)="$eJzs3c9PXFsdAPDvveB7gO9V+t5bPBMTJ/ElGjUEulJpYktpKbRYU21j3EwHmLbowDQwGBdd4K6JKxMXjYtGE3esGhZu65/gxmVdN9GFGxOTRszMXOjcy4xMGwZs3+ez4DDnN3zvPZy7uJw007i/ulla3SxV1kv15bub50q/qNe21qqRDt5wROTHj+2THJ/XMIjr5BSvvc+9G5eu/Oj2uYg/r/z1xd7e3l40DUdXUx3f/+ufD5c7031poU2z3+69HZefRsQnh+bVNBQRP/lTRBIRF7O8mSwdjYgz0S67/fDXd0rHNJunz6vnyy8XH+1Of7aw82S398+eRPyu9uVv31v7+9eGpv/2zWMaHgAAAAAAAAAAAAAAAACAt9zczRu3fjg5Fc+SGN5JDr+vO5elvd6P3Ts2Xx38DwsAAAAAAAAAAAAAAAAAAAD/p169/19KPury/v9sll7o0X7v+4OfI4Mz/4Mbs5cnp7Lz35ND5d/Jsv5xcSjOdjn3vXj++8VC++7nvx8e503tz29/3PFI0pGO8vFI04mJiD9kB79/moyltfpm41t361vrK8c2jbdWPv7t0/tz0ckO9O83/jOF/gd//v/Hh66m5uc7x3eJvdPy8R/qWe+Pv0r6iv+lfLPHA5p2h48HP8Q7LB//4VbeaGeF99tJM/6/GT46/rOF/gd1/5+JiFLSnGsptwI09zDN/F77FfLy8f9CKy+3dGa/yF73/78L8b9c6P+01v/t4h8iusrH/71W3kiuRnsD0Ip/evT9f6XQ/2nEvzn/bX//+5KPf7bYD+eqtH6T/a7/c4X+u8S/9ybjNdxKs3meSXJXwE7Szu/1/+rIy8d/5FD5q+e/tK/939VC+5N6/tsft/n8N9HxHPKNpP38R3f5+I/2rNfv/T9faDfo9f9Ca//Hm8rHf6yVl987j7e+9hv/hUL/g4p/a1cysh//V+vJf95v5//e/q8v+fh/sZ2ZdtbYbn1t7f+So/f/1wr9n8b+rzn/7XSwo74r8vH/oGe9Zvz/ksV97H/c/9cL7QYf/4hJe/03lo//hz3rte7/kaPX/8VCu0HH/+uD7BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLTCTpeORpBO5z2k6MRFxKfv8aYwlS5WV8lKtvvzzzYjZLL8UHyX3avWlSq28ul5fqZYrtVp9OeJyVv5JjCSbtXqjvFZ5cOWgr9HkfrWy0ViqVhoRMZflfyU+3O9rabWxVnkQEVcPyr6U1jce3K+sl1dWN743OTk5GfMHczibVH/ZqK432qO3SyMWDtqOJx2TaxVfO5jLB8nP6lsb65VaK/96R5tafblS62izmJX9Ns4mjY2t9eVKo1qu1e/tj3eaLmTp7PzNH9+8PnWo/E7STmdOdloAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvKZn0999HBHD7U9pRJSS5jfv9aj/9Hn1fPnl4qPd6c8Wdp7svoiI5CTnCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAf9mBAwEAAAAAIP/XRqiqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrCLt2jRBAEYQCtbgUNPYbRMJOZjiiigSOCJ9BjeBg9ipfwDgYGpgbLwm4PLPMDy8Amy3tJQX9UV0MXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBs7p67l6e6iUhxvjqL+Hr7/tnNH0r9uJ7uP1kw83RBD4dx/9jd3NZN+fc0yq/K0W+bN+n/3/trTNTe52BPhvu0NZ4zNLdvc+/r515EylVEtCW/TDlX1X53AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa3bgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwA8cCAAAAAML8raPo2wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4FcAAAD//0yJHBw=") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) sendmmsg$unix(r0, &(0x7f0000000000), 0x651, 0x0) 5.228144172s ago: executing program 2 (id=2602): syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x200000, &(0x7f0000000040)={[{@grpquota}]}, 0x1, 0xbaf, &(0x7f0000002f00)="$eJzs3M1rXOUaAPDnnEy+c5v0crn3tggGpCqK07QpFbpqXYsKunDZmExKyPTDJIIJXaR1ry5EXBSkf4Lg3m5cCS7qQutfUMQiRTdtFyNnPtKxk5mm6cwcE38/eHPe97wn8zxPTmfOe2BOA/jHms5+pBGHIuJsEjFZ359GxFC1NxKxWTvu/t3L81lLolJ5+7ckkoi4d/fyfOO1kvp2vD4YiYibryXx749a466ubyzPlcullfr46Nr5S0dX1zdeWTo/d650rnThxOyrJ2ZPzs52sdbbl9774pkf3nj+6vWPZ978/MB3SZyOifpccx3dMh3TW3+TZoWImOt2sJwM1OtprjMp5JgQAAAdpU1ruP/GZAzEw8XbZHz7Y67JAQAAAF1RGYioAAAAAPtc4v4fAAAA9rnG9wDu3b0832j5fiOhv+6ciYipWv2N55trM4XYrG5HYjAixn5Povmx1qT2a09tOov09felrEWPnkPuZPNKRPx/u/OfVOufqj7F3Vp/GhEzXYg//ch4L9V/ugvxn6z+4S5EBICIG2dqF7LW61+6tf6Jba5/hW2uXbuR9/W/sf6737L+e1j/QJv131s7jHH4wUs32801r//e/eTnhSx+tn2qop7AnSsRhwvb1Z9s1Z+0qf/sDmOMz9++1m4uqz+rt9H6XX/lesSR6mqutf6GpNP/T3R0calcmqn93Ob11092jt98/rOWxW/cC/RDdv7HYnfn/9IOY0z979dD7eYeX3/6y1DyTrU3VN/z4dza2sqxiKHk9db9xzvn0jim8RpZ/S8+1/n9v1392WfCZv3vkP3ruVLfZuOrj8QcP3L8q93X31tZ/Qu7PP+f7jDGl99ce7/dXN71AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALA3pBExEUla3OqnabEYMR4R/4mxtHxxde3lxYsfXFjI5iKmYjBdXCqXZiJisjZOsvGxav/h+Pgj49mIOBgRn02OVsfF+YvlhbyLBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYMt4RExEkhYjIo2IPybTtFjMOysAAACg66byTgAAAADoOff/AAAAsP+13P8X/jIa6WcuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7EsHn71xK4mIzVOj1ZYZqs8N5poZ0Gvpzg4b63UeQP8N5J0AkJtCU79SqVRyTAXoM/f4QPKY+ZG2M8NdzwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAv68XDt24lUTE5qnRassM1ecGc80M6LU07wSA3Ax0mkweuwPYwwp5JwDkxj0+UFvZP6jUtM6PtP3N4aeOCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDeMVFtSVqMiLTaT9NiMeJfETEVg8niUrk0ExEHIuKnycHhbHws76QBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoutX1jeW5crm0oqOj08XOaPQt1mj9zdzmmOH2Ux06OX8wAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACQi9X1jeW5crm0spp3JgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDeVtc3lufK5dJKDzt51wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQH7+DAAA///6CAm5") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r0, 0x1000) mremap(&(0x7f0000a47000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) 5.015404648s ago: executing program 1 (id=2603): openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$dsp(0xffffffffffffff9c, 0x0, 0x62f82, 0x0) mkdir(0x0, 0x1ff) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x82, 0x0) read$dsp(r4, 0x0, 0x0) io_uring_register$IORING_REGISTER_SEND_MSG_RING(r2, 0x1f, &(0x7f0000000540)={0x28, 0x18, 0x0, r1, &(0x7f0000000440)="c91d501d75b221eb8d497d72f4000000000000000055bc94a2869787a4f801517084c801d4474cd9fe7df7b67e8a4e5c64281e5682570c7f42861532e0a8aea9fd5b8654a411760726388c99910066d27f9d891cc424f69504933b0bc1cf686504740954a23e5108800fb6d270", 0x1, 0x8, 0x6, 0x1, {0x0, 0x0, r0, 0x10001}}, 0x1) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0x14}}, 0x0) ioctl$GIO_SCRNMAP(r5, 0x4b40, 0x0) 4.963801118s ago: executing program 3 (id=2604): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x400000000010, 0x3, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r0, &(0x7f0000000300), &(0x7f0000000340)=@udp6=r4, 0x2}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000880)=ANY=[], 0x0) 4.828456352s ago: executing program 3 (id=2605): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x4d) msgctl$IPC_RMID(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r1, 0x0, 0x0) 3.784236717s ago: executing program 1 (id=2606): r0 = gettid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r0}}}], 0x18}}], 0x1, 0x800) 3.602033252s ago: executing program 2 (id=2607): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_mount_image$udf(&(0x7f0000000c40), &(0x7f0000000c80)='./file0\x00', 0x800000, &(0x7f00000000c0)=ANY=[@ANYBLOB='lastblock=00000000000000000226,adinicb,gid=forget,nostrict,unhide,uid=', @ANYRESDEC=0x0, @ANYBLOB="2c73686f727461642c7569643d69676e6f72652c73686f727461642c766f6c756d653d30303030303030303030303030303030303030362c001829935912ddb19b617db523a6bb7c0d782285ef952b9282ba93ba5ef9353deee866199e1a1a16f9b8980aa11304cc9667f126de9a575a9cb3c29169cb6e8bd4820f0d3882914f9f4dd2ac97c7c5181676dc89c5fd4f9c455fcdbd2eef48adb33cdc1f9e9a7f3a2bcb07fb13cffd272aa79076e8039f7ab310e76e7400"/192, @ANYRES64], 0x4, 0xc24, &(0x7f0000000d00)="$eJzs3V9oXOl5B+D3myOtJW/TzG42zh/nYmAD2Xqzi2R51yregBwrIgvGa1ZWLhYKGluyO6w0kiW5eEMJLiSUkLa45CKXNWwCvauvWggNuFfbEgKiV6UXxW03Zns3CaQtvViVM/ONNNLalrK2JXn9PMb+nTnznpnvzOrVnDN7zpwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACK+/o2TQ8Npr0cBAOymM5NvDo14/weAJ8o5+/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwvRRHfjRTv/qCVptu3OwZON5pXrk6NT9x9scEUKSpRtOvLvwPDR0eOvfLq8dFu3n/5h+0L8cbkuZO1Uwvzi0uzy8uzM7WpZuPCwszsjh/hQZff6kj7BajNv31l5uLF5drRl0c23X21eufA04eqJ0YPj7zVrZ0an5iY7Knp6//Yz/4R6eE9FJ8gT0UR34wU7730QapHRCUevBe2+d3xqA1GX9l/7ZWYGp9or8hco95cKe9MlVzVF1HtWWis2yO70IsPZCziWvnfqRzwkXL1JhfrS/Xzc7O1s/WllcZKY6GZKp3RlutTjUqMpojFiGgVez149pv+KOJYpLjz61Y6HxFFtw9ePDP55tDI9g/QtwuDvMfTVouI1XgMehb2qQNRxF9Gih9OD8WF3Ffttnk/4itlvhZxucxbKa7n26n8BTEa8SvvJ/BY64sifhEpFlIrzXR7v71defpbtdebFxd6arvblY/9/sFusm3CPjYQRZxvb/G30sf/sAsAAAAAAAAAAAAA2B1F/DRS3Jx/IS1G7zmljeal2rn6+bnOUcHdY/9ream1tbW1aupkLedQzrGcZ3NO51zMeS3n9Zw3ct7MeSvnas7bOVs5o5KfP2ct51DOsZxnc07nXMx5Lef1nDdy3sx5K+dqzts5WznDeU8AAAAAAAAAAAAAAAAAAAA8ZINRxESkuPHuH7WvKx3t69J/+sTomfHneq8Z/7ltHqesfTkifho7uyZvf77WeKqUfx7+egHbG4givpOv//cnez0YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgX6hEEd+NFD/6TStFioixiOno5O1ir0cHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJQGUhGnIsV/fWOgfXs1Ir4YER+ulX8i/ndtq70eMQAAAAAAAAAAAAAAAAAAAHwCpSIuR4ofv9dK1Yi4Wr1z4OlD1ROjh0feKqKIVJb01r8xee5k7dTC/OLS7PLy7Extqtm4sDAzu9OnGzjdaF65OjU+8UhWZluDj3j8gwOnFhbfWWpc+sOVu95/cODk+eWVpfqFu98dg9EXMdQ750h7wFPjE+1BzzXqzfaiqXKPAfZF1Ha6MgAAAAAAAAAAAAAAAAAAAOwbB1MR45Hi+Z8dS93zxvs65/x/qnOrWK/9yR9vfBfA3Jbs6v3+gJ1Mp50O9Ej7xPva1PjExGTP7L7+j5aWY0qpiM9GisN///n2+fApDt713Piy7s8ixej/Hct11cNl3dimqoEjU+MTtTMLzZdOzs0tXKiv1M/PzdYmF+sXdvzFAQAAAAAAAAAAAAAAAAAAAHAfB1MRfx4pjr2+mrrXnc/n//d1bvWc//9aRPey8wNpc65rn9v/u+1z+zvTnz4x+vrR5+81/1Gc/1+OKaUiPowUz/zV59vX0++e/z+0pbas+3Gk+MX3vpTrKk+VdcPd1ek84sXG3OxQWftipPj+2W5ttGtfzbWf2agdLmv/IVI8+weba4/n2uc2ao+WtXcixcSZu9d+dqN2pKwdjBRf/dNat/ZgWfv1XHtoo/blCwtzMzt9eXkylf3/b5Hiy8PfTN2f+Xv2f8/3f1zbkus+0vP3n35Y/V/tmXct9/Va7v/hbfr/cqT4i+tfynWd3jua73+m/e9G/38/UvzepzbXvpJrn92oHd7pasFeKvv/nyLF6u1/Wf+Zz/2fO2ujQ3v7/4t9m7O7XbBX/f9Mz7xqHtfIb/lawJNm+Z1vv12fm5tdMmHChIn1ib3+zQQ8auX2/39Hiq9dLlJ3PzZv//9O59bG/v//fGdj+//Elly3R9v/z/bMO5H3Wvr7IgZW5hf7PxcxsPzOt19qzNcvzV6abY6MjB7//WPDR48P9z/V3bnfmNrxawePu7L/344UP/mbf17/HHvz/v/dP/87uCXX7VH/f6Z3nTbt1+z4pYAnTtn/fx0p/vXGB+v/v+l+n/91P+d74fnNOdgt2qP+f65nXi3/M9oz74Ui4uROnwsAAAAAAAAAAB4TB1MRP4sUf9v6x/Vr3m8+/ie+3K3tPf7vXvbD9f8BgPsr3/8nI8XPD341db9DZifH/89syXV7dPzvoZ55M7t0XvOOX2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPiYUhRxIFK8+4NWul2UtzsGTjeaV65OjU/cfbHBFCkqUbTry78Dw0dHjr3y6vHRbt5/+YftC/HG5LmTtVML84tLs8vLszO1qWbjwsLM7I4f4UGX3+pI+wWozb99ZebixeXa0ZdHNt19tXrnwNOHqidGD4+81a2dGp+YmOyp6ev/2M/+EenhPRSfIE9FET+PFO+99EH69yKiEg/eC9v87njUBqOv7L/2SkyNT7RXZK5Rb66Ud6ZKruqLqPYsNNbtkV3oxQcyFnEtIirlgI+Uqze5WF+qn5+brZ2tL600VhoLzVTpjLZcn2pUYjRFLEZEq9jrwbPf9EcRfxcp7vy6lf6jiCi6ffDimck3h0a2f4C+XRjkPZ62WkSsxmPQs7BPHYginosUP5weiv8sOn3Vbpv3I75S5msRl8u8leJ6vp3KXxCjEb/yfgKPtb4o4mykWEit9H6Re7+9XXn6W7XXmxcXemq725WP/f7BbrJtwj42EEX8sr3F30q/9H4OAAAAAAAAAAAAAPtcEV+LFDfnX0jt80PXzyltNC/VztXPz3UO6+8e+1/LS62tra1VUydrOYdyjuU8m3M652LOazmv57yR82bOWzlXc97O2coZlfz8OWs5h3KO5TybczrnYs5rOa/nvJHzZs5bOVdz3s7ZyhmOkwYAAAAAAAAAAAAAAAAA4BGpRBHfixQ/+k0rrRWd68tORydvO88VPtH+PwAA//9mFkcG") r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) getdents64(r0, 0xfffffffffffffffe, 0x29) read$msr(0xffffffffffffffff, &(0x7f0000025300)=""/102392, 0x18ff8) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xe, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x5, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x9, 0x4, 0x2, 0x762, 0x3, 0x80, 0x3, 0x2b12, 0x100, 0x6, 0x1c04, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x80000000, 0x5, 0x79b, 0x2, 0x1, 0x7d, 0x4, 0x2, 0x7, 0xd, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x8, 0x180000, 0x400a, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x5, 0x6, 0x9, 0x9, 0xb, 0x4009, 0x0, 0x4, 0xffffff01, 0x8, 0x752, 0x0, 0x1005, 0x5, 0x10001, 0x2, 0xffffffff, 0x6, 0x4, 0x9, 0x7ffffffe, 0xfdffffff, 0xfffffffe, 0x2, 0x84, 0x800100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0xffffffff, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x2, 0x2, 0x5, 0x1, 0x0, 0x0, 0x2, 0x40, 0x8, 0x4, 0x3, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, 0x0) sendmmsg$inet_sctp(r2, &(0x7f00000032c0), 0x0, 0x0) setsockopt(r1, 0x84, 0x81, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000006c0)=ANY=[@ANYBLOB="2800000010000100000000001000000085ff00003b000000000000000000000008001c00c9"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06daab01a77}, 0x40) 3.103275524s ago: executing program 3 (id=2608): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x0, 0x0) setreuid(0x0, 0xee00) ioctl(r0, 0xc138fd06, 0x0) 2.86616609s ago: executing program 1 (id=2609): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x20}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000240)={@hyper, 0x1}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, &(0x7f0000000080)={{@hyper, 0x2}, @any, 0x0, 0x7fff, 0x2, 0x6, 0x9a6, 0x8000, 0x8}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000400)={&(0x7f000000c300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWFLOWTABLE={0x60, 0x16, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'netdevsim0\x00'}]}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x88}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(0xffffffffffffffff, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e}) socket$inet6_tcp(0xa, 0x1, 0x0) 2.759405872s ago: executing program 3 (id=2610): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') r1 = add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, 0x0) sendmmsg$inet(r2, &(0x7f00000028c0), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) close(r2) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c9"], 0x16) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1}, &(0x7f0000000240)=""/186, 0xba, &(0x7f0000000440)={0x0, &(0x7f00000003c0)="a72f976605f2c4f756fda55f7fbb8ae19a80bc96c1c7c487736029646cce7944d346c750dc2eeafc1ac58789b5f2755f2355d0ef497159302cd549c8e27b05f63d5d2121", 0x44}) 2.758601242s ago: executing program 2 (id=2611): r0 = syz_open_dev$ndb(&(0x7f0000000280), 0x0, 0x61c7c039d0921a4e) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, 0x0, 0x440b0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r4, r4) waitid(0x2, r4, 0x0, 0x4, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0xe07e872420dfefca) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfdef) ioctl(0xffffffffffffffff, 0xc138fd04, &(0x7f0000000000)) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x0, 0x0, 0x0, 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x3000000}, 0x50) open(&(0x7f00000000c0)='./file0\x00', 0x0, 0xa5) ioctl$NBD_DO_IT(r0, 0xab03) mount$9p_xen(0x0, 0x0, 0x0, 0x8005, 0x0) 2.543496708s ago: executing program 3 (id=2612): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x2) write$binfmt_aout(r1, &(0x7f0000000200)=ANY=[], 0xc8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x20004450) write$proc_mixer(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="50484f4e45494e0e0400000000000065272030303030303030301430303030303030303030300a4449474954414c310a"], 0x30) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000400)={0x0, &(0x7f0000000140)=[0x0], &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r4, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0x1000, 0x101c, 0x10, 0x4, 0x401, 0x100, 0xa, 0x0, 0x52, 0x43, 0x7e9, 0x401, 0x9aa5, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}}) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x101000, 0x0) ioctl$KVM_GET_MSRS_sys(r6, 0xc008ae88, &(0x7f00000000c0)={0x2, 0x0, [{0x491, 0x0, 0x8}, {0x9ff, 0x0, 0x7}]}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f00000003c0)={&(0x7f0000000280)=[r4, r5], 0x2}) socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.551188652s ago: executing program 1 (id=2613): r0 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0xc02) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000080)={0x0, 0xfff, 0x9}) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) socket$netlink(0x10, 0x3, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1) r3 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r2, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x10000, 0x1000000, &(0x7f0000000000/0x1000000)=nil, 0x0, r3}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c00000041000100fcff07000400000001000000040048800c00018008000f00e00000"], 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f0000000340)={0x10000, 0x1000000}) r6 = socket(0x1e, 0x5, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) listen(r6, 0x0) accept4$inet6(r6, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000004) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040)=0x800, 0x4) close(r0) 1.426036325s ago: executing program 4 (id=2614): r0 = socket$igmp(0x2, 0x3, 0x2) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000004c0)={0x0, 0x0, 0x5, 0x7ff, @vifc_lcl_addr=@local, @multicast1}, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x1, 0x0, 0x0, @vifc_lcl_addr=@local, @multicast1}, 0x10) 1.131251803s ago: executing program 3 (id=2615): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x203, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000c27000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f00000000c0)={0x100003, 0x0, {[0x10400001, 0x100000000, 0x1, 0x6, 0x6, 0x0, 0x7, 0xfffffffffffffffe]}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.048845564s ago: executing program 4 (id=2616): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x4d) msgctl$IPC_RMID(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r1, 0x0, 0x0) 1.033402274s ago: executing program 2 (id=2617): r0 = gettid() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000002140)=@abs={0x0, 0x0, 0x4e21}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@cred={{0x18, 0x1, 0x2, {r0}}}], 0x18}}], 0x1, 0x800) 730.052342ms ago: executing program 2 (id=2618): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, 0x0, 0x0) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000140)=0x4, 0x4) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) 55.609678ms ago: executing program 4 (id=2619): syz_mount_image$tmpfs(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)) mkdir(&(0x7f0000000140)='./config\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000300)='01234', 0x5) close(0xffffffffffffffff) mkdir(&(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', 0x1ff) mkdir(0x0, 0x1ff) r0 = open(0x0, 0x241, 0x1ff) write(r0, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)='720', 0x3) close(0xffffffffffffffff) r1 = open(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/dwMaxVideoFrameBufferSize\x00', 0x241, 0x1ff) write(r1, &(0x7f00000006c0)='184', 0x3) close(r1) r2 = open(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv/720p/dwFrameInterval\x00', 0x241, 0x1ff) write(r2, 0x0, 0x0) mkdir(&(0x7f00000007c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) symlink(&(0x7f0000000800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/yuyv\x00', &(0x7f0000000880)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/yuyv\x00') symlink(0x0, &(0x7f0000000940)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlink(&(0x7f0000000980)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f00000009c0)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlink(&(0x7f0000000a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x0) mkdir(&(0x7f0000000a80)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0x1ff) 0s ago: executing program 1 (id=2620): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00') r1 = add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, 0x0) sendmmsg$inet(r2, &(0x7f00000028c0), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) close(r2) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c9"], 0x16) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1}, &(0x7f0000000240)=""/186, 0xba, &(0x7f0000000440)={0x0, &(0x7f00000003c0)="a72f976605f2c4f756fda55f7fbb8ae19a80bc96c1c7c487736029646cce7944d346c750dc2eeafc1ac58789b5f2755f2355d0ef497159302cd549c8e27b05f63d5d2121", 0x44}) kernel console output (not intermixed with test programs): 73.597527][T12691] UDF-fs: error (device loop2): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 674.138980][T12691] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 674.213091][T12674] loop0: detected capacity change from 0 to 32768 [ 674.221913][T12691] UDF-fs: Scanning with blocksize 512 failed [ 674.309681][T12674] JBD2: Ignoring recovery information on journal [ 674.318643][T12691] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 674.586233][T12697] ceph: No mds server is up or the cluster is laggy [ 674.594669][ T5810] libceph: connect (1)[c::]:6789 error -101 [ 674.642275][T12674] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 674.664651][T12705] loop1: detected capacity change from 0 to 16 [ 674.710307][ T5810] libceph: mon0 (1)[c::]:6789 connect error [ 674.735451][T11356] Bluetooth: hci1: hcon ffff88807de4e000 sent 0 < count 1 [ 674.769189][T12705] erofs: (device loop1): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 675.041461][ T5810] libceph: connect (1)[c::]:6789 error -101 [ 675.167937][ T5810] libceph: mon0 (1)[c::]:6789 connect error [ 675.541269][T12715] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2081'. [ 675.914814][ T5770] ocfs2: Unmounting device (7,0) on (node local) [ 676.564378][T12725] 9pnet_fd: p9_fd_create_tcp (12725): problem connecting socket to 127.0.0.1 [ 677.049621][T12732] loop2: detected capacity change from 0 to 2048 [ 677.089543][T12732] UDF-fs: error (device loop2): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 677.102298][T12732] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 677.130898][T12732] UDF-fs: Scanning with blocksize 512 failed [ 677.371875][T12741] loop3: detected capacity change from 0 to 16 [ 677.400839][T11356] Bluetooth: hci2: hcon ffff88807c670000 sent 0 < count 1 [ 677.953922][T12741] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 677.980373][T12732] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 678.356303][T12752] block nbd2: Cannot use ioctl interface on a netlink controlled device. [ 678.392105][T12755] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2093'. [ 678.500436][ T9] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 678.554591][T12759] block nbd2: Cannot use ioctl interface on a netlink controlled device. [ 678.570520][T12759] block nbd2: shutting down sockets [ 678.598017][T12765] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2094'. [ 678.720237][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 678.728893][ T9] usb 2-1: config index 0 descriptor too short (expected 74, got 45) [ 678.758633][ T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 679.419938][ T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 679.430187][ T9] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 679.441480][ T9] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 679.445765][T12771] 9pnet_fd: p9_fd_create_tcp (12771): problem connecting socket to 127.0.0.1 [ 679.452076][ T9] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 679.541268][ T9] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 679.597905][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 679.830057][T12787] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2100'. [ 679.849506][T12787] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2100'. [ 679.888410][ T9] usb 2-1: GET_CAPABILITIES returned 0 [ 679.911262][ T9] usbtmc 2-1:16.0: can't read capabilities [ 680.063895][T12791] loop2: detected capacity change from 0 to 16 [ 680.090916][T11356] Bluetooth: hci3: hcon ffff888030a74000 sent 0 < count 1 [ 680.334021][T12791] erofs: (device loop2): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 680.748370][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 680.774504][T12743] usbtmc 2-1:16.0: Unable to send data, error -71 [ 680.786750][ T5812] usb 2-1: USB disconnect, device number 21 [ 680.876988][T12798] loop2: detected capacity change from 0 to 2048 [ 680.897069][T12798] UDF-fs: error (device loop2): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 680.907973][T12802] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2104'. [ 680.917701][ T9] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 680.931399][T12798] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 680.942362][T12798] UDF-fs: Scanning with blocksize 512 failed [ 680.970541][T12798] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 681.119972][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 681.136972][ T9] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 681.156565][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.181185][ T9] usb 4-1: Product: syz [ 681.185412][ T9] usb 4-1: Manufacturer: syz [ 681.209831][ T9] usb 4-1: SerialNumber: syz [ 681.957327][ T9] usb 4-1: config 0 descriptor?? [ 681.959645][T12812] 9pnet_fd: p9_fd_create_tcp (12812): problem connecting socket to 127.0.0.1 [ 681.965905][ T9] gspca_main: se401-2.14.0 probing 047d:5003 [ 682.534822][ T9] gspca_se401: ExtraFeatures: 255 [ 682.768486][ T9] input: se401 as /devices/platform/dummy_hcd.3/usb4/4-1/input/input9 [ 682.824280][ T9] usb 4-1: USB disconnect, device number 25 [ 683.146852][T12828] loop0: detected capacity change from 0 to 1024 [ 683.226325][T12828] EXT4-fs: Ignoring removed orlov option [ 683.349573][T12828] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 683.375564][T12838] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2113'. [ 683.458147][T12839] loop1: detected capacity change from 0 to 16 [ 683.483041][T12839] erofs: (device loop1): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 683.503715][T11356] Bluetooth: hci1: hcon ffff88807de4e000 sent 0 < count 1 [ 684.073156][T12828] jffs2: notice: (12828) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 684.463987][T12853] kvm: requested 2514 ns i8254 timer period limited to 200000 ns [ 684.544121][T12853] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 684.790505][T12853] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 684.873274][T12853] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 684.919775][T12853] kvm: requested 85485 ns i8254 timer period limited to 200000 ns [ 684.958722][T12853] kvm: requested 93028 ns i8254 timer period limited to 200000 ns [ 685.072534][T12853] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 685.131304][T12828] syz.0.2109 (12828): drop_caches: 2 [ 685.158698][T12853] kvm: requested 10057 ns i8254 timer period limited to 200000 ns [ 685.171245][T12853] kvm: requested 155047 ns i8254 timer period limited to 200000 ns [ 685.190470][T12857] 9pnet_fd: p9_fd_create_tcp (12857): problem connecting socket to 127.0.0.1 [ 685.248004][T12853] kvm: requested 160914 ns i8254 timer period limited to 200000 ns [ 685.263380][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.291369][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.306690][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.338069][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.384994][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.399184][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.440651][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.467526][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.487431][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.501989][ T5770] EXT4-fs warning (device loop0): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 685.711537][T10889] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 685.882820][T12871] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2123'. [ 686.024963][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.031617][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.042989][ T1293] aoe: packet could not be sent on ipvlan0. consider increasing tx_queue_len [ 686.200057][ T5810] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 686.326206][T12882] loop1: detected capacity change from 0 to 16 [ 686.345896][T12882] erofs: (device loop1): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 686.373208][T11356] Bluetooth: hci1: hcon ffff88807de4e000 sent 0 < count 1 [ 686.466611][ T5810] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 686.546255][ T5810] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 686.769309][ T5810] usb 4-1: Product: syz [ 686.864133][ T5810] usb 4-1: Manufacturer: syz [ 686.906900][ T5810] usb 4-1: SerialNumber: syz [ 686.950819][ T5810] usb 4-1: config 0 descriptor?? [ 688.178334][T12900] 9pnet_fd: p9_fd_create_tcp (12900): problem connecting socket to 127.0.0.1 [ 688.249548][ T5810] usb 4-1: ATUSB: AT86RF231 version 69 [ 688.475069][ T5810] usb 4-1: Firmware version (0.0) predates our first public release. [ 688.582217][ T5810] usb 4-1: Please update to version 0.2 or newer [ 688.785995][ T5810] usb 4-1: USB disconnect, device number 26 [ 689.086563][ T5774] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 689.115257][T12925] loop2: detected capacity change from 0 to 512 [ 689.122229][ T5774] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 689.134740][ T5774] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 689.155725][ T5774] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 689.171918][ T5774] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 689.179338][ T5774] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 689.262445][T12925] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 689.299501][T12925] ext4 filesystem being mounted at /589/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 690.178150][T12922] chnl_net:caif_netlink_parms(): no params data found [ 690.837148][T12948] loop3: detected capacity change from 0 to 16 [ 690.850113][ T5774] Bluetooth: hci2: hcon ffff88807c670000 sent 0 < count 1 [ 690.888931][T12922] bridge0: port 1(bridge_slave_0) entered blocking state [ 690.908635][T12922] bridge0: port 1(bridge_slave_0) entered disabled state [ 690.917288][T12948] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 690.922984][ T5772] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 690.957443][T12922] bridge_slave_0: entered allmulticast mode [ 690.985762][T12922] bridge_slave_0: entered promiscuous mode [ 691.028231][T12922] bridge0: port 2(bridge_slave_1) entered blocking state [ 691.048952][T12922] bridge0: port 2(bridge_slave_1) entered disabled state [ 691.060211][T12922] bridge_slave_1: entered allmulticast mode [ 691.069265][T12922] bridge_slave_1: entered promiscuous mode [ 691.125758][T12953] 9pnet_fd: p9_fd_create_tcp (12953): problem connecting socket to 127.0.0.1 [ 691.300144][T11356] Bluetooth: hci0: command tx timeout [ 691.518949][T12922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 691.650598][T12922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 692.035927][T12922] team0: Port device team_slave_0 added [ 692.066139][T12922] team0: Port device team_slave_1 added [ 692.220982][T12922] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 692.235679][T12922] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 692.263266][T12922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 692.288760][T12922] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 692.300898][T12922] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 692.327650][T12922] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 692.623442][T12977] loop1: detected capacity change from 0 to 512 [ 692.641981][T12922] hsr_slave_0: entered promiscuous mode [ 692.658142][T12922] hsr_slave_1: entered promiscuous mode [ 692.676752][T12922] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 692.686614][T12922] Cannot create hsr debugfs directory [ 692.720664][T12977] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 692.751516][T12977] ext4 filesystem being mounted at /498/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 693.052190][T12988] loop2: detected capacity change from 0 to 16 [ 693.130327][T11356] Bluetooth: hci3: hcon ffff888030a74000 sent 0 < count 1 [ 693.303709][T12988] erofs: (device loop2): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 693.382029][ T5774] Bluetooth: hci0: command tx timeout [ 695.150859][T13002] 9pnet_fd: p9_fd_create_tcp (13002): problem connecting socket to 127.0.0.1 [ 695.463949][ T5774] Bluetooth: hci0: command tx timeout [ 697.478696][T12922] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 697.563610][ T5774] Bluetooth: hci0: command tx timeout [ 697.583123][T12922] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 697.631695][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 697.720761][T12922] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 697.831765][T12922] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 698.173081][ T9] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 698.271485][T12922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 698.332822][T12922] 8021q: adding VLAN 0 to HW filter on device team0 [ 698.370038][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 698.383230][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 698.390501][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 698.406576][ T9] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 698.420197][ T9] usb 2-1: config 2 has no interface number 0 [ 698.421558][ T789] page_pool_release_retry() stalled pool shutdown 1 inflight 607 sec [ 698.439925][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 698.447550][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 698.455413][ T9] usb 2-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 698.486226][ T9] usb 2-1: config 2 interface 88 has no altsetting 0 [ 698.496122][ T9] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 698.530385][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 698.538437][ T9] usb 2-1: Product: syz [ 698.544959][ T9] usb 2-1: Manufacturer: syz [ 698.549606][ T9] usb 2-1: SerialNumber: syz [ 698.577375][T13016] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 698.758116][T12922] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 698.826893][T13031] loop3: detected capacity change from 0 to 16 [ 698.844737][ T5774] Bluetooth: hci2: hcon ffff88807c670000 sent 0 < count 1 [ 698.918594][T13031] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 699.114041][T13016] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 700.035939][T12922] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 700.515372][T13049] 9pnet_fd: p9_fd_create_tcp (13049): problem connecting socket to 127.0.0.1 [ 700.539011][T13053] loop3: detected capacity change from 0 to 512 [ 700.622107][T13053] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 700.835786][ T9] asix 2-1:2.88 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 700.964138][T13053] ext4 filesystem being mounted at /568/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 701.059161][ T9] asix: probe of 2-1:2.88 failed with error -71 [ 701.284782][ T9] usb 2-1: USB disconnect, device number 22 [ 702.526977][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 703.468763][T12922] veth0_vlan: entered promiscuous mode [ 703.637724][T12922] veth1_vlan: entered promiscuous mode [ 703.749234][T12922] veth0_macvtap: entered promiscuous mode [ 703.809817][T13100] loop3: detected capacity change from 0 to 16 [ 703.825865][ T5774] Bluetooth: hci2: hcon ffff88807c670000 sent 0 < count 1 [ 703.842616][T13100] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 704.650368][T13103] 9pnet_fd: p9_fd_create_tcp (13103): problem connecting socket to 127.0.0.1 [ 704.755596][T12922] veth1_macvtap: entered promiscuous mode [ 704.922302][T12922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 705.805595][T12922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 705.815611][T12922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 705.826373][T12922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 705.837779][T12922] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 705.848526][T12922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 705.859806][T12922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 705.869851][T12922] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 705.950112][T12922] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 705.963750][T12922] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 706.018332][T12922] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.027680][T12922] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.050093][T12922] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.066922][T12922] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.540379][ T23] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 706.830213][ T23] usb 2-1: Using ep0 maxpacket: 8 [ 706.923927][ T23] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 707.045853][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 707.068241][ T23] usb 2-1: config 0 has no interface number 0 [ 707.183419][ T23] usb 2-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 707.194149][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 707.324292][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 707.455013][ T23] usb 2-1: Product: syz [ 707.519756][ T23] usb 2-1: Manufacturer: syz [ 707.580216][ T23] usb 2-1: SerialNumber: syz [ 707.714365][ T23] usb 2-1: config 0 descriptor?? [ 707.875338][ T23] usb 2-1: selecting invalid altsetting 2 [ 707.962308][ T23] i2c-cp2615: probe of 2-1:0.1 failed with error -22 [ 707.992349][ T8926] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 708.106500][ T8926] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 709.158473][ T5804] usb 2-1: USB disconnect, device number 23 [ 709.389997][ T5810] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 709.444198][T13133] loop4: detected capacity change from 0 to 8192 [ 709.600225][ T5810] usb 3-1: Using ep0 maxpacket: 8 [ 709.631363][ T5810] usb 3-1: config 0 interface 0 has no altsetting 0 [ 709.644015][ T5810] usb 3-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 709.666779][ T5810] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 709.721038][ T5810] usb 3-1: config 0 descriptor?? [ 709.898685][T12922] FAT-fs (loop4): error, invalid access to FAT (entry 0x0000e1b1) [ 709.915426][T12922] FAT-fs (loop4): Filesystem has been set read-only [ 710.189138][ T5810] logitech-djreceiver 0003:046D:C513.0003: unknown main item tag 0x1 [ 710.249142][ T5810] logitech-djreceiver 0003:046D:C513.0003: collection stack underflow [ 710.686393][T13149] 9pnet_fd: p9_fd_create_tcp (13149): problem connecting socket to 127.0.0.1 [ 710.824817][ T5810] logitech-djreceiver 0003:046D:C513.0003: item 0 2 0 12 parsing failed [ 710.834226][ T5810] logitech-djreceiver 0003:046D:C513.0003: logi_dj_probe: parse failed [ 710.842955][ T5810] logitech-djreceiver: probe of 0003:046D:C513.0003 failed with error -22 [ 710.854840][ T5810] usb 3-1: USB disconnect, device number 7 [ 713.380330][ T5812] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 713.470012][ T23] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 713.660155][ T5812] usb 2-1: Using ep0 maxpacket: 8 [ 713.734246][ T5812] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 713.788209][ T23] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 713.843649][ T5812] usb 2-1: config 0 has no interface number 0 [ 713.894303][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 713.932105][ T5812] usb 2-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 714.042100][ T5812] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.057943][ T23] usb 4-1: config 0 descriptor?? [ 714.165220][ T5812] usb 2-1: Product: syz [ 714.221997][ T23] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 714.237140][ T5812] usb 2-1: Manufacturer: syz [ 714.301664][ T5812] usb 2-1: SerialNumber: syz [ 714.515973][ T5812] usb 2-1: config 0 descriptor?? [ 714.718832][ T5812] usb 2-1: selecting invalid altsetting 2 [ 714.795195][ T5812] i2c-cp2615: probe of 2-1:0.1 failed with error -22 [ 715.921679][ T23] usb 4-1: USB disconnect, device number 27 [ 716.111426][T10370] usb 2-1: USB disconnect, device number 24 [ 716.186796][T13174] loop4: detected capacity change from 0 to 32768 [ 716.232935][T13174] (syz.4.2187,13174,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 716.286322][T11356] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 716.290840][T13174] (syz.4.2187,13174,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 716.312056][T11356] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 716.318916][T13174] JBD2: Ignoring recovery information on journal [ 716.331161][T11356] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 716.339314][T11356] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 716.351467][T11356] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 716.359072][T11356] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 716.444569][T13174] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 717.288418][T13190] loop3: detected capacity change from 0 to 512 [ 717.372950][T13186] 9pnet_fd: p9_fd_create_tcp (13186): problem connecting socket to 127.0.0.1 [ 717.530534][T13190] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 717.564261][T13190] ext4 filesystem being mounted at /576/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 718.422971][ T5774] Bluetooth: hci4: command tx timeout [ 719.171076][T12922] ocfs2: Unmounting device (7,4) on (node local) [ 719.173339][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 719.306261][T13177] chnl_net:caif_netlink_parms(): no params data found [ 719.634141][T13177] bridge0: port 1(bridge_slave_0) entered blocking state [ 719.748577][T13177] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.832183][T13177] bridge_slave_0: entered allmulticast mode [ 719.891630][T10370] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 719.938434][T13177] bridge_slave_0: entered promiscuous mode [ 720.053255][T13177] bridge0: port 2(bridge_slave_1) entered blocking state [ 720.122331][T13177] bridge0: port 2(bridge_slave_1) entered disabled state [ 720.160115][T10370] usb 4-1: Using ep0 maxpacket: 8 [ 720.187011][T13177] bridge_slave_1: entered allmulticast mode [ 720.215586][T10370] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 720.275375][T13177] bridge_slave_1: entered promiscuous mode [ 720.284875][T10370] usb 4-1: config 0 has no interface number 0 [ 720.374512][T10370] usb 4-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 720.490340][T10370] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.510285][ T5774] Bluetooth: hci4: command tx timeout [ 720.587061][T10370] usb 4-1: Product: syz [ 721.835297][T13224] 9pnet_fd: p9_fd_create_tcp (13224): problem connecting socket to 127.0.0.1 [ 721.847071][T10370] usb 4-1: Manufacturer: syz [ 721.853131][T10370] usb 4-1: SerialNumber: syz [ 721.993891][T10370] usb 4-1: config 0 descriptor?? [ 722.183037][T10370] usb 4-1: selecting invalid altsetting 2 [ 722.259572][T10370] i2c-cp2615: probe of 4-1:0.1 failed with error -22 [ 722.454478][T13177] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 722.590258][ T5774] Bluetooth: hci4: command tx timeout [ 722.685525][T13177] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 723.404068][ T23] usb 4-1: USB disconnect, device number 28 [ 723.427801][T13177] team0: Port device team_slave_0 added [ 723.502878][T13177] team0: Port device team_slave_1 added [ 723.876317][T13236] loop3: detected capacity change from 0 to 512 [ 723.912704][T13177] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 723.995183][T13177] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 724.344294][T13177] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 724.347767][T13236] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 724.358618][T13177] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 724.374554][T13177] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 724.400647][T13177] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 724.450404][T13236] ext4 filesystem being mounted at /579/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 724.507128][T13177] hsr_slave_0: entered promiscuous mode [ 724.530196][T13229] loop4: detected capacity change from 0 to 32768 [ 724.537167][T13177] hsr_slave_1: entered promiscuous mode [ 724.576840][T13229] (syz.4.2201,13229,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 724.595600][T13177] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 724.613132][T13177] Cannot create hsr debugfs directory [ 724.670112][ T5774] Bluetooth: hci4: command tx timeout [ 724.700254][T13229] (syz.4.2201,13229,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 725.247077][T13229] JBD2: Ignoring recovery information on journal [ 725.377356][T13229] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 725.543436][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 725.738439][T13177] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.990680][ T5774] Bluetooth: hci2: hcon ffff88807c670000 sent 0 < count 1 [ 725.998591][T13253] loop3: detected capacity change from 0 to 16 [ 726.007692][T13253] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 726.010391][T13177] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.062602][T11711] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 726.179425][T13177] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.247814][T12922] ocfs2: Unmounting device (7,4) on (node local) [ 726.384070][T13177] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.027219][T13263] 9pnet_fd: p9_fd_create_tcp (13263): problem connecting socket to 127.0.0.1 [ 727.067199][ T23] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 727.300066][ T23] usb 2-1: Using ep0 maxpacket: 8 [ 727.307296][ T23] usb 2-1: config 0 interface 0 has no altsetting 0 [ 727.315176][ T23] usb 2-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 727.332722][ T23] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 727.375019][ T23] usb 2-1: config 0 descriptor?? [ 727.685909][T13177] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 727.760176][T10370] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 727.963365][T13177] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 727.994910][ T23] usbhid 2-1:0.0: can't add hid device: -71 [ 728.050629][T10370] usb 4-1: Using ep0 maxpacket: 8 [ 728.074969][ T23] usbhid: probe of 2-1:0.0 failed with error -71 [ 728.118596][T10370] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 729.541409][T13177] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 729.914998][T10370] usb 4-1: config 0 has no interface number 0 [ 729.925357][ T23] usb 2-1: USB disconnect, device number 25 [ 729.934402][T10370] usb 4-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 729.942133][T13177] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 729.948866][T10370] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 729.958725][T10370] usb 4-1: Product: syz [ 729.962987][T10370] usb 4-1: Manufacturer: syz [ 729.967796][T10370] usb 4-1: SerialNumber: syz [ 729.975368][T10370] usb 4-1: config 0 descriptor?? [ 729.983956][T10370] usb 4-1: selecting invalid altsetting 2 [ 729.989750][T10370] i2c-cp2615: probe of 4-1:0.1 failed with error -22 [ 730.052875][T13273] loop4: detected capacity change from 0 to 512 [ 730.147052][T13273] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 730.193965][ T23] usb 4-1: USB disconnect, device number 29 [ 730.255429][T13273] ext4 filesystem being mounted at /10/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 730.327772][T13177] 8021q: adding VLAN 0 to HW filter on device bond0 [ 730.836303][T13177] 8021q: adding VLAN 0 to HW filter on device team0 [ 730.943048][ T8913] bridge0: port 1(bridge_slave_0) entered blocking state [ 730.950258][ T8913] bridge0: port 1(bridge_slave_0) entered forwarding state [ 730.978633][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 730.985825][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 731.058981][T12922] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 731.147963][T13277] loop1: detected capacity change from 0 to 32768 [ 731.168455][T13277] (syz.1.2215,13277,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 731.260547][T13277] (syz.1.2215,13277,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 731.376236][T13277] JBD2: Ignoring recovery information on journal [ 731.452633][ T5774] Bluetooth: hci2: hcon ffff88807c670000 sent 0 < count 1 [ 731.460651][T13292] loop3: detected capacity change from 0 to 16 [ 731.471784][T13292] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 731.562381][T13298] 9pnet_fd: p9_fd_create_tcp (13298): problem connecting socket to 127.0.0.1 [ 731.758170][T13277] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 732.183363][T11711] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 732.415987][T13177] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 732.533679][T13177] veth0_vlan: entered promiscuous mode [ 732.817927][T13177] veth1_vlan: entered promiscuous mode [ 733.538559][T13177] veth0_macvtap: entered promiscuous mode [ 733.560712][T13177] veth1_macvtap: entered promiscuous mode [ 735.421376][T13177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 735.432297][T13177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.442929][T13177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 735.453609][T13177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.463666][T13177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 735.475258][T13177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.487085][T13177] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 735.501644][T13177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.512399][T13177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.522587][T13177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.533259][T13177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.548615][T13177] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 735.554656][T13314] loop3: detected capacity change from 0 to 512 [ 735.559715][T13177] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 735.577813][ T5769] ocfs2: Unmounting device (7,1) on (node local) [ 735.578451][T13177] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 735.628958][T13177] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.654674][T13314] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 735.667832][T13177] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.667907][T13177] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.667934][T13177] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.702451][T13314] ext4 filesystem being mounted at /585/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 736.414840][T13054] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 736.448993][T13054] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 737.339476][T13202] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 737.350455][T13202] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 737.417197][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 738.284943][T13331] 9pnet_fd: p9_fd_create_tcp (13331): problem connecting socket to 127.0.0.1 [ 738.336367][T13332] loop4: detected capacity change from 0 to 16 [ 738.351537][T13332] erofs: (device loop4): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 739.232374][T13337] netlink: 1624 bytes leftover after parsing attributes in process `syz.1.2229'. [ 739.312731][T13336] 9pnet_fd: p9_fd_create_tcp (13336): problem connecting socket to 127.0.0.1 [ 740.416069][T13352] loop4: detected capacity change from 0 to 512 [ 740.471884][T13352] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 740.539448][T13342] loop2: detected capacity change from 0 to 32768 [ 740.550500][T13352] ext4 filesystem being mounted at /19/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 740.570044][T13342] (syz.2.2230,13342,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 740.600417][T13342] (syz.2.2230,13342,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 741.380831][T13120] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 741.594056][T13342] JBD2: Ignoring recovery information on journal [ 741.815512][T13120] usb 2-1: Using ep0 maxpacket: 8 [ 741.886848][T13120] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 742.061032][T12922] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 742.071728][T13120] usb 2-1: config 0 has no interface number 0 [ 742.184875][T13120] usb 2-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 742.308678][T13120] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 742.439050][T13342] JBD2: journal reset failed [ 742.461068][T13120] usb 2-1: Product: syz [ 742.507465][T13342] (syz.2.2230,13342,1):ocfs2_journal_load:1168 ERROR: Failed to load journal! [ 742.537112][T13120] usb 2-1: Manufacturer: syz [ 742.615228][T13120] usb 2-1: SerialNumber: syz [ 742.659212][T13342] (syz.2.2230,13342,1):ocfs2_check_volume:2430 ERROR: ocfs2 journal load failed! -4 [ 742.770847][T13120] usb 2-1: config 0 descriptor?? [ 742.941995][T13120] usb 2-1: selecting invalid altsetting 2 [ 743.047335][T13120] i2c-cp2615: probe of 2-1:0.1 failed with error -22 [ 744.129697][ T789] usb 2-1: USB disconnect, device number 26 [ 744.209163][T13369] netlink: 1624 bytes leftover after parsing attributes in process `syz.1.2241'. [ 744.599569][T13375] loop4: detected capacity change from 0 to 16 [ 744.876385][ T5774] Bluetooth: hci0: hcon ffff88802ef90000 sent 0 < count 1 [ 744.914939][T13375] erofs: (device loop4): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 744.988202][T13377] 9pnet_fd: p9_fd_create_tcp (13377): problem connecting socket to 127.0.0.1 [ 746.164017][T13382] 9pnet_fd: p9_fd_create_tcp (13382): problem connecting socket to 127.0.0.1 [ 746.383584][T13390] loop1: detected capacity change from 0 to 512 [ 746.565557][T13393] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2243'. [ 746.929006][T13390] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 747.122160][T13390] ext4 filesystem being mounted at /530/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 747.532647][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.561959][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.587300][ T1293] aoe: packet could not be sent on ipvlan0. consider increasing tx_queue_len [ 748.990549][ T789] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 750.424919][T13410] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.2250'. [ 750.487179][ T5769] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 750.630056][ T789] usb 3-1: Using ep0 maxpacket: 8 [ 750.648518][ T789] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 750.677578][ T789] usb 3-1: config 0 has no interface number 0 [ 750.705524][ T789] usb 3-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 750.758420][T13403] loop4: detected capacity change from 0 to 32768 [ 750.772392][T13403] (syz.4.2247,13403,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 750.813822][T13403] (syz.4.2247,13403,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 750.872998][ T789] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 750.881168][ T789] usb 3-1: Product: syz [ 750.885357][ T789] usb 3-1: Manufacturer: syz [ 750.890021][ T789] usb 3-1: SerialNumber: syz [ 750.897087][ T789] usb 3-1: config 0 descriptor?? [ 750.936787][ T789] usb 3-1: selecting invalid altsetting 2 [ 750.943069][ T789] i2c-cp2615: probe of 3-1:0.1 failed with error -22 [ 751.016638][T13419] loop1: detected capacity change from 0 to 16 [ 751.320108][ T5774] Bluetooth: hci1: hcon ffff88807de4e000 sent 0 < count 1 [ 751.337417][T13419] erofs: (device loop1): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 751.471554][T13403] workqueue: Failed to create a rescuer kthread for wq "ocfs2_wq": -EINTR [ 751.472057][T13403] (syz.4.2247,13403,0):ocfs2_initialize_super:2283 ERROR: status = -12 [ 751.994808][T13420] 9pnet_fd: p9_fd_create_tcp (13420): problem connecting socket to 127.0.0.1 [ 752.073260][T13403] (syz.4.2247,13403,1):ocfs2_fill_super:1178 ERROR: status = -12 [ 752.103682][ T5804] usb 3-1: USB disconnect, device number 8 [ 752.430305][ T5810] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 752.700307][ T5810] usb 2-1: Using ep0 maxpacket: 8 [ 752.792783][ T5810] usb 2-1: config 0 interface 0 has no altsetting 0 [ 752.896380][ T5810] usb 2-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 753.050979][ T5810] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.348664][ T5810] usb 2-1: config 0 descriptor?? [ 753.376129][T13441] loop3: detected capacity change from 0 to 512 [ 753.508103][T13441] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 753.570571][T13441] ext4 filesystem being mounted at /596/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 754.313163][ T5810] usbhid 2-1:0.0: can't add hid device: -71 [ 754.319832][ T5810] usbhid: probe of 2-1:0.0 failed with error -71 [ 754.328339][ T5810] usb 2-1: USB disconnect, device number 27 [ 755.488319][T13460] loop4: detected capacity change from 0 to 16 [ 755.622687][ T5774] Bluetooth: hci0: hcon ffff88802ef90000 sent 0 < count 1 [ 755.640534][T13460] erofs: (device loop4): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 755.750541][ T5771] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 756.637623][T13463] 9pnet_fd: p9_fd_create_tcp (13463): problem connecting socket to 127.0.0.1 [ 758.754683][ T5812] page_pool_release_retry() stalled pool shutdown 1 inflight 667 sec [ 761.283389][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 761.293565][ T5774] CPU: 1 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 761.301151][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 761.311242][ T5774] Workqueue: hci1 hci_rx_work [ 761.315968][ T5774] Call Trace: [ 761.319273][ T5774] [ 761.322222][ T5774] dump_stack_lvl+0x18c/0x250 [ 761.326937][ T5774] ? show_regs_print_info+0x20/0x20 [ 761.332166][ T5774] ? load_image+0x420/0x420 [ 761.336726][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 761.341867][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 761.346910][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 761.351591][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 761.356796][ T5774] kobject_add_internal+0x617/0xc90 [ 761.362007][ T5774] kobject_add+0x164/0x240 [ 761.366423][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 761.371796][ T5774] ? kobject_init+0x1d0/0x1d0 [ 761.376476][ T5774] ? get_device_parent+0x366/0x390 [ 761.381612][ T5774] device_add+0x3fa/0xc40 [ 761.386080][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 761.391062][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 761.396362][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 761.402618][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 761.408342][ T5774] ? lockdep_hardirqs_on+0x98/0x150 [ 761.413540][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 761.418255][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 761.423803][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 761.429871][ T5774] hci_event_packet+0x7b4/0x1280 [ 761.434821][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 761.440462][ T5774] ? bis_list+0x290/0x290 [ 761.444819][ T5774] ? kcov_remote_start+0x1b5/0x7e0 [ 761.450036][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 761.455235][ T5774] hci_rx_work+0x43a/0xd60 [ 761.459740][ T5774] ? process_scheduled_works+0x975/0x1600 [ 761.465471][ T5774] process_scheduled_works+0xa60/0x1600 [ 761.471050][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 761.476599][ T5774] ? assign_work+0x3cc/0x5d0 [ 761.481208][ T5774] worker_thread+0xa5e/0xfe0 [ 761.485810][ T5774] kthread+0x2fa/0x390 [ 761.489874][ T5774] ? pr_cont_work+0x550/0x550 [ 761.494564][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 761.499147][ T5774] ret_from_fork+0x48/0x80 [ 761.503560][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 761.508165][ T5774] ret_from_fork_asm+0x11/0x20 [ 761.512934][ T5774] [ 761.518587][ T5774] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 761.533084][ T5774] Bluetooth: hci1: failed to register connection device [ 762.972750][T13498] 9pnet_fd: p9_fd_create_tcp (13498): problem connecting socket to 127.0.0.1 [ 763.550263][ T5812] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 763.620979][T11356] Bluetooth: hci1: command 0x0406 tx timeout [ 763.816026][ T5812] usb 3-1: Using ep0 maxpacket: 8 [ 763.892006][ T5812] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 763.977799][ T5812] usb 3-1: config 0 has no interface number 0 [ 764.150855][ T5812] usb 3-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 764.223107][ T5812] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.510833][ T5774] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 765.524230][ T5774] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 765.550567][ T5774] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 765.575562][ T5774] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 765.606908][ T5774] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 765.624657][ T5774] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 765.730162][ T5812] usb 3-1: Product: syz [ 765.734409][ T5812] usb 3-1: Manufacturer: syz [ 765.739052][ T5812] usb 3-1: SerialNumber: syz [ 765.747001][ T5812] usb 3-1: config 0 descriptor?? [ 765.761918][ T5812] usb 3-1: selecting invalid altsetting 2 [ 765.779941][ T5812] i2c-cp2615: probe of 3-1:0.1 failed with error -22 [ 766.036243][ T5812] usb 3-1: USB disconnect, device number 9 [ 766.927294][T13509] chnl_net:caif_netlink_parms(): no params data found [ 766.975273][T13512] loop4: detected capacity change from 0 to 32768 [ 767.003445][T13512] (syz.4.2282,13512,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 767.025517][T13512] (syz.4.2282,13512,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 767.274817][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 767.294829][T11356] CPU: 0 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 767.302533][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 767.312601][T11356] Workqueue: hci1 hci_rx_work [ 767.317291][T11356] Call Trace: [ 767.320574][T11356] [ 767.323604][T11356] dump_stack_lvl+0x18c/0x250 [ 767.328292][T11356] ? show_regs_print_info+0x20/0x20 [ 767.333495][T11356] ? load_image+0x420/0x420 [ 767.338021][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 767.343141][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 767.348196][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 767.352902][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 767.358206][T11356] kobject_add_internal+0x617/0xc90 [ 767.363434][T11356] kobject_add+0x164/0x240 [ 767.367866][T11356] ? kobject_init+0x1d0/0x1d0 [ 767.372816][T11356] ? get_device_parent+0x366/0x390 [ 767.377975][T11356] device_add+0x3fa/0xc40 [ 767.382333][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 767.387283][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 767.392585][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 767.398832][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 767.404687][T11356] ? mutex_unlock+0x10/0x10 [ 767.409216][T11356] ? skb_pull_data+0xf0/0x1f0 [ 767.413903][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 767.419472][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 767.425595][T11356] hci_event_packet+0x7b4/0x1280 [ 767.430558][T11356] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 767.436298][T11356] ? bis_list+0x290/0x290 [ 767.440653][T11356] ? kcov_remote_start+0x1b5/0x7e0 [ 767.445779][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 767.450985][T11356] hci_rx_work+0x43a/0xd60 [ 767.455422][T11356] ? process_scheduled_works+0x975/0x1600 [ 767.461324][T11356] process_scheduled_works+0xa60/0x1600 [ 767.466897][T11356] ? worker_attach_to_pool+0x370/0x370 [ 767.472366][T11356] ? assign_work+0x3cc/0x5d0 [ 767.476986][T11356] worker_thread+0xa5e/0xfe0 [ 767.481615][T11356] ? _raw_spin_unlock+0x40/0x40 [ 767.486479][T11356] ? __kthread_parkme+0x71/0x1c0 [ 767.491425][T11356] kthread+0x2fa/0x390 [ 767.495500][T11356] ? pr_cont_work+0x550/0x550 [ 767.500181][T11356] ? kthread_blkcg+0xd0/0xd0 [ 767.504773][T11356] ret_from_fork+0x48/0x80 [ 767.509228][T11356] ? kthread_blkcg+0xd0/0xd0 [ 767.513821][T11356] ret_from_fork_asm+0x11/0x20 [ 767.518598][T11356] [ 767.672466][T11356] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 767.686556][T11356] Bluetooth: hci1: failed to register connection device [ 767.762115][T13512] JBD2: Ignoring recovery information on journal [ 767.782665][ T5774] Bluetooth: hci3: command tx timeout [ 767.872688][T13512] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 767.880432][T13509] bridge0: port 1(bridge_slave_0) entered blocking state [ 767.889180][T13509] bridge0: port 1(bridge_slave_0) entered disabled state [ 767.897135][T13509] bridge_slave_0: entered allmulticast mode [ 767.905053][T13509] bridge_slave_0: entered promiscuous mode [ 767.922711][T13509] bridge0: port 2(bridge_slave_1) entered blocking state [ 767.930401][T13509] bridge0: port 2(bridge_slave_1) entered disabled state [ 767.943033][T13509] bridge_slave_1: entered allmulticast mode [ 767.950993][T13509] bridge_slave_1: entered promiscuous mode [ 767.998394][T13509] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 768.017832][T13509] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 768.106707][T13509] team0: Port device team_slave_0 added [ 768.145954][T13509] team0: Port device team_slave_1 added [ 768.208506][T13509] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 768.252515][T13509] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 768.293440][T13509] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 768.373757][T13509] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 768.381165][T13509] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 768.454325][T13544] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2289'. [ 769.005468][T13509] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 769.016536][T12922] ocfs2: Unmounting device (7,4) on (node local) [ 769.123105][T13545] overlayfs: overlapping lowerdir path [ 769.471600][T13509] hsr_slave_0: entered promiscuous mode [ 769.514569][T13509] hsr_slave_1: entered promiscuous mode [ 769.521849][T13509] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 769.529535][T13509] Cannot create hsr debugfs directory [ 770.200025][ T5774] Bluetooth: hci1: command 0x0406 tx timeout [ 770.206190][ T5774] Bluetooth: hci3: command tx timeout [ 772.045497][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 772.055108][T11356] CPU: 1 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 772.062752][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 772.072807][T11356] Workqueue: hci1 hci_rx_work [ 772.077517][T11356] Call Trace: [ 772.080795][T11356] [ 772.083720][T11356] dump_stack_lvl+0x18c/0x250 [ 772.088397][T11356] ? show_regs_print_info+0x20/0x20 [ 772.093941][T11356] ? load_image+0x420/0x420 [ 772.098461][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 772.103578][T11356] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 772.109246][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 772.113927][T11356] ? kobject_add_internal+0x602/0xc90 [ 772.119327][T11356] kobject_add_internal+0x617/0xc90 [ 772.124557][T11356] kobject_add+0x164/0x240 [ 772.129018][T11356] ? preempt_schedule_thunk+0x1a/0x30 [ 772.134394][T11356] ? kobject_init+0x1d0/0x1d0 [ 772.139074][T11356] ? get_device_parent+0x366/0x390 [ 772.144216][T11356] device_add+0x3fa/0xc40 [ 772.148545][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 772.153490][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 772.158786][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 772.165027][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 772.170659][T11356] ? mutex_unlock+0x10/0x10 [ 772.175162][T11356] ? skb_pull_data+0xf0/0x1f0 [ 772.179939][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 772.185494][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 772.191578][T11356] hci_event_packet+0x7b4/0x1280 [ 772.196535][T11356] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 772.202174][T11356] ? bis_list+0x290/0x290 [ 772.206500][T11356] ? kcov_remote_start+0x1b5/0x7e0 [ 772.211613][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 772.216829][T11356] hci_rx_work+0x43a/0xd60 [ 772.221252][T11356] ? process_scheduled_works+0x975/0x1600 [ 772.226974][T11356] process_scheduled_works+0xa60/0x1600 [ 772.232563][T11356] ? worker_attach_to_pool+0x370/0x370 [ 772.238034][T11356] ? assign_work+0x3cc/0x5d0 [ 772.242643][T11356] worker_thread+0xa5e/0xfe0 [ 772.247257][T11356] ? _raw_spin_unlock+0x40/0x40 [ 772.252106][T11356] ? __kthread_parkme+0x71/0x1c0 [ 772.257070][T11356] kthread+0x2fa/0x390 [ 772.261160][T11356] ? pr_cont_work+0x550/0x550 [ 772.265849][T11356] ? kthread_blkcg+0xd0/0xd0 [ 772.270438][T11356] ret_from_fork+0x48/0x80 [ 772.274872][T11356] ? kthread_blkcg+0xd0/0xd0 [ 772.279464][T11356] ret_from_fork_asm+0x11/0x20 [ 772.284236][T11356] [ 772.553040][ T5774] Bluetooth: hci3: command tx timeout [ 772.558781][T11356] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 772.573886][T11356] Bluetooth: hci1: failed to register connection device [ 773.312688][T13574] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2300'. [ 773.898007][T13575] overlayfs: overlapping lowerdir path [ 774.580493][T11356] Bluetooth: hci3: command tx timeout [ 774.660018][ T5774] Bluetooth: hci1: command 0x0406 tx timeout [ 775.881181][T13564] loop1: detected capacity change from 0 to 32768 [ 776.010145][T13564] (syz.1.2297,13564,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 776.098838][T13509] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 776.106878][T13564] (syz.1.2297,13564,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 776.144266][T13583] loop2: detected capacity change from 0 to 512 [ 776.145053][T13564] workqueue: Failed to create a rescuer kthread for wq "ocfs2_wq": -EINTR [ 776.167595][T13509] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 776.178055][T13564] (syz.1.2297,13564,1):ocfs2_initialize_super:2283 ERROR: status = -12 [ 776.211320][T13564] (syz.1.2297,13564,1):ocfs2_fill_super:1178 ERROR: status = -12 [ 776.217653][T13509] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 776.237515][T13509] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 776.272184][T13583] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 776.310181][T13583] ext4 filesystem being mounted at /20/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 776.942296][T13509] 8021q: adding VLAN 0 to HW filter on device bond0 [ 777.118126][T13509] 8021q: adding VLAN 0 to HW filter on device team0 [ 777.157872][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 777.165108][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 777.173322][T13177] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 777.219918][T13202] bridge0: port 2(bridge_slave_1) entered blocking state [ 777.227093][T13202] bridge0: port 2(bridge_slave_1) entered forwarding state [ 777.625737][T13608] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2310'. [ 778.509606][T13509] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 778.609714][T13509] veth0_vlan: entered promiscuous mode [ 778.626258][T13509] veth1_vlan: entered promiscuous mode [ 778.665498][T13509] veth0_macvtap: entered promiscuous mode [ 778.946421][T13509] veth1_macvtap: entered promiscuous mode [ 779.024412][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 779.036836][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.068354][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 779.093148][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.117210][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 779.128484][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.139040][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 779.150627][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.172192][T13509] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 779.192477][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 779.205406][T13612] loop4: detected capacity change from 0 to 32768 [ 779.210504][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.233869][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 779.254457][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.274348][T13612] (syz.4.2313,13612,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 779.304266][T13612] (syz.4.2313,13612,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 779.309935][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 779.369501][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.414004][T13624] loop2: detected capacity change from 0 to 512 [ 779.417571][T13509] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 779.460276][T13612] JBD2: Ignoring recovery information on journal [ 779.469471][T13509] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 779.504101][T13509] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 779.510835][T13624] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 779.569643][T13624] ext4 filesystem being mounted at /23/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 779.586379][T13509] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.595318][T13509] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.604274][T13509] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.614762][T13509] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 779.630817][T13612] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 780.616147][T13637] 9pnet_fd: p9_fd_create_tcp (13637): problem connecting socket to 127.0.0.1 [ 781.373892][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 781.394826][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 781.430664][T13177] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 781.449656][ T8909] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 781.466886][ T8909] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 781.525907][T12922] ocfs2: Unmounting device (7,4) on (node local) [ 781.922748][T13649] loop3: detected capacity change from 0 to 16 [ 781.933794][T13649] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 783.921589][T11711] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 784.169671][T13670] 9pnet_fd: p9_fd_create_tcp (13670): problem connecting socket to 127.0.0.1 [ 785.094497][T13674] loop4: detected capacity change from 0 to 512 [ 785.175826][T13674] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 785.207274][T13674] ext4 filesystem being mounted at /43/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 785.857215][T13669] loop1: detected capacity change from 0 to 32768 [ 785.888549][T13669] (syz.1.2328,13669,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 785.902957][T13669] (syz.1.2328,13669,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 785.932693][T13669] JBD2: Ignoring recovery information on journal [ 785.957946][T12922] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 786.133638][T13669] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 786.710043][ T5769] ocfs2: Unmounting device (7,1) on (node local) [ 787.793123][T13700] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2339'. [ 787.907985][T13705] loop4: detected capacity change from 0 to 512 [ 787.954556][T13705] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 788.510147][T13705] ext4 filesystem being mounted at /47/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 788.756067][ T5774] Bluetooth: hci1: hcon ffff88807de4e000 sent 0 < count 1 [ 788.764592][T13712] loop1: detected capacity change from 0 to 16 [ 788.775115][T13712] erofs: (device loop1): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 789.172844][T13719] 9pnet_fd: p9_fd_create_tcp (13719): problem connecting socket to 127.0.0.1 [ 790.562272][T12922] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 792.366296][T13721] loop1: detected capacity change from 0 to 32768 [ 792.388674][T13721] (syz.1.2345,13721,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 792.644083][T13721] (syz.1.2345,13721,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 792.662910][T13742] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2351'. [ 792.793788][T13721] JBD2: Ignoring recovery information on journal [ 792.911867][T13721] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 793.064988][ T5774] Bluetooth: hci0: hcon ffff88802ef90000 sent 0 < count 1 [ 793.076127][T13746] loop4: detected capacity change from 0 to 16 [ 793.087390][T13746] erofs: (device loop4): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 793.131182][ T5763] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 793.630303][T13759] 9pnet_fd: p9_fd_create_tcp (13759): problem connecting socket to 127.0.0.1 [ 796.074653][ T5769] ocfs2: Unmounting device (7,1) on (node local) [ 796.135101][T13767] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2361'. [ 797.052540][T13773] loop2: detected capacity change from 0 to 16 [ 797.062337][T13773] erofs: (device loop2): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 797.416302][T11711] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 797.913182][T13790] 9pnet_fd: p9_fd_create_tcp (13790): problem connecting socket to 127.0.0.1 [ 798.680902][T13780] loop2: detected capacity change from 0 to 32768 [ 798.762552][T13780] (syz.2.2365,13780,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 798.987676][T13780] (syz.2.2365,13780,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 800.698836][T13780] workqueue: Failed to create a rescuer kthread for wq "ocfs2_wq": -EINTR [ 800.699300][T13780] (syz.2.2365,13780,0):ocfs2_initialize_super:2283 ERROR: status = -12 [ 800.731125][T13780] (syz.2.2365,13780,1):ocfs2_fill_super:1178 ERROR: status = -12 [ 800.984850][T13808] loop3: detected capacity change from 0 to 16 [ 800.992772][ T5774] Bluetooth: hci3: hcon ffff888078e96000 sent 0 < count 1 [ 801.014189][T13808] erofs: (device loop3): erofs_read_inode: bogus i_mode (0) @ nid 36 [ 801.039558][T13807] netlink: 1688 bytes leftover after parsing attributes in process `syz.2.2372'. [ 801.405511][ T5763] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 802.652325][T13822] 9pnet_fd: p9_fd_create_tcp (13822): problem connecting socket to 127.0.0.1 [ 804.556853][T13829] loop4: detected capacity change from 0 to 32768 [ 804.658557][T13829] (syz.4.2380,13829,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 804.723309][T13829] (syz.4.2380,13829,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 804.802696][T13829] JBD2: Ignoring recovery information on journal [ 804.962860][T13829] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 805.013348][T13844] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.2386'. [ 805.589185][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 805.599035][ T5774] CPU: 0 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 805.606646][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 805.616736][ T5774] Workqueue: hci1 hci_rx_work [ 805.621458][ T5774] Call Trace: [ 805.624761][ T5774] [ 805.627712][ T5774] dump_stack_lvl+0x18c/0x250 [ 805.632445][ T5774] ? show_regs_print_info+0x20/0x20 [ 805.637690][ T5774] ? load_image+0x420/0x420 [ 805.642244][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 805.647392][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 805.652471][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 805.657198][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 805.662530][ T5774] kobject_add_internal+0x617/0xc90 [ 805.667778][ T5774] kobject_add+0x164/0x240 [ 805.672235][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 805.677654][ T5774] ? kobject_init+0x1d0/0x1d0 [ 805.682421][ T5774] ? get_device_parent+0x366/0x390 [ 805.687654][ T5774] device_add+0x3fa/0xc40 [ 805.692046][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 805.697041][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 805.702383][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 805.708673][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 805.714441][ T5774] ? mutex_unlock+0x10/0x10 [ 805.719000][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 805.723736][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 805.729377][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 805.735503][ T5774] hci_event_packet+0x7b4/0x1280 [ 805.740752][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 805.746427][ T5774] ? bis_list+0x290/0x290 [ 805.750810][ T5774] ? kcov_remote_start+0x1b5/0x7e0 [ 805.755966][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 805.761208][ T5774] hci_rx_work+0x43a/0xd60 [ 805.765670][ T5774] ? process_scheduled_works+0x975/0x1600 [ 805.771434][ T5774] process_scheduled_works+0xa60/0x1600 [ 805.777067][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 805.782583][ T5774] ? assign_work+0x3cc/0x5d0 [ 805.787222][ T5774] worker_thread+0xa5e/0xfe0 [ 805.791891][ T5774] kthread+0x2fa/0x390 [ 805.795995][ T5774] ? pr_cont_work+0x550/0x550 [ 805.800716][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 805.805349][ T5774] ret_from_fork+0x48/0x80 [ 805.809928][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 805.814558][ T5774] ret_from_fork_asm+0x11/0x20 [ 805.819473][ T5774] [ 805.845295][ T5774] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 805.861025][ T5774] Bluetooth: hci1: failed to register connection device [ 806.109087][T12922] ocfs2: Unmounting device (7,4) on (node local) [ 807.873458][T13868] 9pnet_fd: p9_fd_create_tcp (13868): problem connecting socket to 127.0.0.1 [ 808.402539][T11356] Bluetooth: hci1: command 0x0406 tx timeout [ 808.830686][T13875] netlink: 1688 bytes leftover after parsing attributes in process `syz.3.2395'. [ 808.913752][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.923025][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.937081][ T1293] aoe: packet could not be sent on ipvlan0. consider increasing tx_queue_len [ 809.825612][T13887] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 811.309105][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 811.319062][T13879] loop1: detected capacity change from 0 to 32768 [ 811.319401][T11356] CPU: 1 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 811.333386][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 811.343443][T11356] Workqueue: hci3 hci_rx_work [ 811.348130][T11356] Call Trace: [ 811.351422][T11356] [ 811.354352][T11356] dump_stack_lvl+0x18c/0x250 [ 811.359139][T11356] ? show_regs_print_info+0x20/0x20 [ 811.364345][T11356] ? load_image+0x420/0x420 [ 811.368857][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 811.373974][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 811.378998][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 811.383690][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 811.389198][T11356] kobject_add_internal+0x617/0xc90 [ 811.394460][T11356] kobject_add+0x164/0x240 [ 811.398883][T11356] ? preempt_schedule_thunk+0x1a/0x30 [ 811.404263][T11356] ? kobject_init+0x1d0/0x1d0 [ 811.409004][T11356] ? get_device_parent+0x366/0x390 [ 811.414156][T11356] device_add+0x3fa/0xc40 [ 811.418579][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 811.423552][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 811.428876][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 811.435129][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 811.441092][T11356] ? mutex_unlock+0x10/0x10 [ 811.445619][T11356] ? skb_pull_data+0xf0/0x1f0 [ 811.450306][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 811.455866][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 811.461955][T11356] hci_event_packet+0x7b4/0x1280 [ 811.466904][T11356] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 811.472543][T11356] ? bis_list+0x290/0x290 [ 811.476874][T11356] ? kcov_remote_start+0x1b5/0x7e0 [ 811.481991][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 811.487270][T11356] hci_rx_work+0x43a/0xd60 [ 811.491806][T11356] ? process_scheduled_works+0x975/0x1600 [ 811.497627][T11356] process_scheduled_works+0xa60/0x1600 [ 811.503273][T11356] ? worker_attach_to_pool+0x370/0x370 [ 811.508756][T11356] ? assign_work+0x3cc/0x5d0 [ 811.513375][T11356] worker_thread+0xa5e/0xfe0 [ 811.517992][T11356] ? _raw_spin_unlock+0x40/0x40 [ 811.522873][T11356] ? __kthread_parkme+0x71/0x1c0 [ 811.527825][T11356] kthread+0x2fa/0x390 [ 811.531910][T11356] ? pr_cont_work+0x550/0x550 [ 811.536592][T11356] ? kthread_blkcg+0xd0/0xd0 [ 811.541190][T11356] ret_from_fork+0x48/0x80 [ 811.545603][T11356] ? kthread_blkcg+0xd0/0xd0 [ 811.550195][T11356] ret_from_fork_asm+0x11/0x20 [ 811.554966][T11356] [ 811.561582][T11356] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 811.661069][T11356] Bluetooth: hci3: failed to register connection device [ 811.838203][T13879] (syz.1.2397,13879,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 811.885761][T13879] (syz.1.2397,13879,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 811.921769][T13879] workqueue: Failed to create a rescuer kthread for wq "ocfs2_wq": -EINTR [ 811.922258][T13879] (syz.1.2397,13879,0):ocfs2_initialize_super:2283 ERROR: status = -12 [ 811.956831][T13879] (syz.1.2397,13879,0):ocfs2_fill_super:1178 ERROR: status = -12 [ 812.229430][T13907] 9pnet_fd: p9_fd_create_tcp (13907): problem connecting socket to 127.0.0.1 [ 812.627823][T13908] netlink: 'syz.2.2406': attribute type 72 has an invalid length. [ 813.780061][T11356] Bluetooth: hci3: command tx timeout [ 815.540517][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 815.554359][T11356] CPU: 0 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 815.562152][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 815.572255][T11356] Workqueue: hci0 hci_rx_work [ 815.576972][T11356] Call Trace: [ 815.580264][T11356] [ 815.583212][T11356] dump_stack_lvl+0x18c/0x250 [ 815.587931][T11356] ? show_regs_print_info+0x20/0x20 [ 815.593156][T11356] ? load_image+0x420/0x420 [ 815.597719][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 815.602861][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 815.607911][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 815.612621][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 815.617882][T11356] kobject_add_internal+0x617/0xc90 [ 815.623137][T11356] kobject_add+0x164/0x240 [ 815.627591][T11356] ? kobject_init+0x1d0/0x1d0 [ 815.632301][T11356] ? get_device_parent+0x366/0x390 [ 815.637443][T11356] device_add+0x3fa/0xc40 [ 815.641806][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 815.646776][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 815.652102][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 815.658385][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 815.664098][T11356] ? mutex_unlock+0x10/0x10 [ 815.668640][T11356] ? skb_pull_data+0xf0/0x1f0 [ 815.673355][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 815.678964][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 815.685155][T11356] hci_event_packet+0x7b4/0x1280 [ 815.690129][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 815.695269][T11356] ? lock_chain_count+0x20/0x20 [ 815.700236][T11356] ? bis_list+0x290/0x290 [ 815.704600][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 815.709845][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 815.715111][T11356] hci_rx_work+0x43a/0xd60 [ 815.719573][T11356] ? process_scheduled_works+0x975/0x1600 [ 815.725328][T11356] process_scheduled_works+0xa60/0x1600 [ 815.731008][T11356] ? worker_attach_to_pool+0x370/0x370 [ 815.736529][T11356] ? assign_work+0x3cc/0x5d0 [ 815.741267][T11356] worker_thread+0xa5e/0xfe0 [ 815.745910][T11356] ? _raw_spin_unlock+0x40/0x40 [ 815.750792][T11356] ? __kthread_parkme+0x71/0x1c0 [ 815.756147][T11356] kthread+0x2fa/0x390 [ 815.760249][T11356] ? pr_cont_work+0x550/0x550 [ 815.765045][T11356] ? kthread_blkcg+0xd0/0xd0 [ 815.769659][T11356] ret_from_fork+0x48/0x80 [ 815.774108][T11356] ? kthread_blkcg+0xd0/0xd0 [ 815.778738][T11356] ret_from_fork_asm+0x11/0x20 [ 815.783551][T11356] [ 815.818197][T11356] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 815.833459][T11356] Bluetooth: hci0: failed to register connection device [ 816.112066][T11356] Bluetooth: hci0: command 0x0406 tx timeout [ 816.403619][T13946] 9pnet_fd: p9_fd_create_tcp (13946): problem connecting socket to 127.0.0.1 [ 818.180180][ T5774] Bluetooth: hci0: command 0x0406 tx timeout [ 819.381216][T13120] page_pool_release_retry() stalled pool shutdown 1 inflight 728 sec [ 819.433871][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 819.445601][ T5774] CPU: 0 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 819.453203][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 819.463293][ T5774] Workqueue: hci1 hci_rx_work [ 819.468006][ T5774] Call Trace: [ 819.471312][ T5774] [ 819.474263][ T5774] dump_stack_lvl+0x18c/0x250 [ 819.478992][ T5774] ? show_regs_print_info+0x20/0x20 [ 819.484234][ T5774] ? load_image+0x420/0x420 [ 819.488807][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 819.494080][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 819.499179][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 819.503898][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 819.509120][ T5774] kobject_add_internal+0x617/0xc90 [ 819.514345][ T5774] kobject_add+0x164/0x240 [ 819.518863][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 819.524276][ T5774] ? kobject_init+0x1d0/0x1d0 [ 819.528983][ T5774] ? get_device_parent+0x366/0x390 [ 819.534109][ T5774] device_add+0x3fa/0xc40 [ 819.538453][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 819.543456][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 819.548768][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 819.555033][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 819.560796][ T5774] ? mutex_unlock+0x10/0x10 [ 819.565305][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 819.569987][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 819.575558][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 819.581638][ T5774] hci_event_packet+0x7b4/0x1280 [ 819.586592][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 819.591622][ T5774] ? lock_chain_count+0x20/0x20 [ 819.596475][ T5774] ? bis_list+0x290/0x290 [ 819.600818][ T5774] ? lockdep_hardirqs_on+0x98/0x150 [ 819.606025][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 819.611228][ T5774] hci_rx_work+0x43a/0xd60 [ 819.615655][ T5774] ? process_scheduled_works+0x975/0x1600 [ 819.621382][ T5774] process_scheduled_works+0xa60/0x1600 [ 819.626955][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 819.632424][ T5774] ? assign_work+0x3cc/0x5d0 [ 819.637023][ T5774] worker_thread+0xa5e/0xfe0 [ 819.641805][ T5774] kthread+0x2fa/0x390 [ 819.645992][ T5774] ? pr_cont_work+0x550/0x550 [ 819.650721][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 819.655320][ T5774] ret_from_fork+0x48/0x80 [ 819.659750][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 819.664355][ T5774] ret_from_fork_asm+0x11/0x20 [ 819.669133][ T5774] [ 819.730046][ T5774] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 819.744392][ T5774] Bluetooth: hci1: failed to register connection device [ 820.917164][T13979] 9pnet_fd: p9_fd_create_tcp (13979): problem connecting socket to 127.0.0.1 [ 821.861950][T11356] Bluetooth: hci1: command 0x0406 tx timeout [ 821.971612][T13991] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2428'. [ 825.221061][T14010] 9pnet_fd: p9_fd_create_tcp (14010): problem connecting socket to 127.0.0.1 [ 826.407866][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 826.418063][T11356] CPU: 0 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 826.425807][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 826.435895][T11356] Workqueue: hci4 hci_rx_work [ 826.440617][T11356] Call Trace: [ 826.443915][T11356] [ 826.446873][T11356] dump_stack_lvl+0x18c/0x250 [ 826.451596][T11356] ? show_regs_print_info+0x20/0x20 [ 826.456844][T11356] ? load_image+0x420/0x420 [ 826.461403][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 826.466548][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 826.471622][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 826.476340][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 826.481582][T11356] kobject_add_internal+0x617/0xc90 [ 826.486833][T11356] kobject_add+0x164/0x240 [ 826.491302][T11356] ? preempt_schedule_thunk+0x1a/0x30 [ 826.496700][T11356] ? kobject_init+0x1d0/0x1d0 [ 826.501391][T11356] ? get_device_parent+0x366/0x390 [ 826.506559][T11356] device_add+0x3fa/0xc40 [ 826.510941][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 826.515885][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 826.521192][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 826.527555][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 826.533213][T11356] ? mutex_unlock+0x10/0x10 [ 826.537758][T11356] ? skb_pull_data+0xf0/0x1f0 [ 826.542450][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 826.548028][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 826.554100][T11356] hci_event_packet+0x7b4/0x1280 [ 826.559043][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 826.564068][T11356] ? lock_chain_count+0x20/0x20 [ 826.568917][T11356] ? bis_list+0x290/0x290 [ 826.573254][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 826.578462][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 826.583669][T11356] hci_rx_work+0x43a/0xd60 [ 826.588097][T11356] ? process_scheduled_works+0x975/0x1600 [ 826.593820][T11356] process_scheduled_works+0xa60/0x1600 [ 826.599399][T11356] ? worker_attach_to_pool+0x370/0x370 [ 826.604871][T11356] ? assign_work+0x3cc/0x5d0 [ 826.609468][T11356] worker_thread+0xa5e/0xfe0 [ 826.614072][T11356] ? _raw_spin_unlock+0x40/0x40 [ 826.618955][T11356] ? __kthread_parkme+0x71/0x1c0 [ 826.623901][T11356] kthread+0x2fa/0x390 [ 826.627974][T11356] ? pr_cont_work+0x550/0x550 [ 826.632651][T11356] ? kthread_blkcg+0xd0/0xd0 [ 826.637503][T11356] ret_from_fork+0x48/0x80 [ 826.641923][T11356] ? kthread_blkcg+0xd0/0xd0 [ 826.646510][T11356] ret_from_fork_asm+0x11/0x20 [ 826.651301][T11356] [ 826.657855][T11356] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 826.678385][T11356] Bluetooth: hci4: failed to register connection device [ 827.130222][T10370] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 827.480331][T10370] usb 3-1: Using ep0 maxpacket: 8 [ 827.564633][T10370] usb 3-1: config 0 interface 0 has no altsetting 0 [ 827.622836][T10370] usb 3-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 828.097072][T14027] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2440'. [ 828.538393][T10370] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 828.568150][T10370] usb 3-1: config 0 descriptor?? [ 828.744304][ T5774] Bluetooth: hci4: command tx timeout [ 829.225830][T10370] usbhid 3-1:0.0: can't add hid device: -71 [ 829.294579][T10370] usbhid: probe of 3-1:0.0 failed with error -71 [ 829.570466][T10370] usb 3-1: USB disconnect, device number 10 [ 829.875331][T14037] Bluetooth: MGMT ver 1.22 [ 830.709098][T14038] 9pnet_fd: p9_fd_create_tcp (14038): problem connecting socket to 127.0.0.1 [ 831.711955][ T5774] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 831.721698][ T5774] CPU: 1 PID: 5774 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 831.729260][ T5774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 831.739327][ T5774] Workqueue: hci1 hci_rx_work [ 831.744017][ T5774] Call Trace: [ 831.747302][ T5774] [ 831.750244][ T5774] dump_stack_lvl+0x18c/0x250 [ 831.754931][ T5774] ? show_regs_print_info+0x20/0x20 [ 831.760226][ T5774] ? load_image+0x420/0x420 [ 831.764765][ T5774] sysfs_create_dir_ns+0x26e/0x2a0 [ 831.769897][ T5774] ? __lock_acquire+0x7d80/0x7d80 [ 831.774967][ T5774] ? sysfs_warn_dup+0xa0/0xa0 [ 831.779688][ T5774] ? do_raw_spin_unlock+0x121/0x230 [ 831.784962][ T5774] kobject_add_internal+0x617/0xc90 [ 831.790245][ T5774] kobject_add+0x164/0x240 [ 831.794727][ T5774] ? preempt_schedule_thunk+0x1a/0x30 [ 831.800115][ T5774] ? kobject_init+0x1d0/0x1d0 [ 831.804824][ T5774] ? get_device_parent+0x366/0x390 [ 831.810129][ T5774] device_add+0x3fa/0xc40 [ 831.814490][ T5774] hci_conn_add_sysfs+0xd5/0x1e0 [ 831.819440][ T5774] le_conn_complete_evt+0xe9f/0x1480 [ 831.824736][ T5774] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 831.830998][ T5774] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 831.836660][ T5774] ? mutex_unlock+0x10/0x10 [ 831.841179][ T5774] ? skb_pull_data+0xf0/0x1f0 [ 831.845874][ T5774] hci_le_conn_complete_evt+0x187/0x440 [ 831.851522][ T5774] ? hci_remote_host_features_evt+0x150/0x150 [ 831.857598][ T5774] hci_event_packet+0x7b4/0x1280 [ 831.862571][ T5774] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 831.868229][ T5774] ? bis_list+0x290/0x290 [ 831.872567][ T5774] ? kcov_remote_start+0x1b5/0x7e0 [ 831.877721][ T5774] ? hci_send_to_monitor+0xd7/0x4f0 [ 831.882943][ T5774] hci_rx_work+0x43a/0xd60 [ 831.887363][ T5774] ? process_scheduled_works+0x975/0x1600 [ 831.893124][ T5774] process_scheduled_works+0xa60/0x1600 [ 831.898696][ T5774] ? worker_attach_to_pool+0x370/0x370 [ 831.904163][ T5774] ? assign_work+0x3cc/0x5d0 [ 831.908757][ T5774] worker_thread+0xa5e/0xfe0 [ 831.913356][ T5774] kthread+0x2fa/0x390 [ 831.917419][ T5774] ? pr_cont_work+0x550/0x550 [ 831.922135][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 831.926741][ T5774] ret_from_fork+0x48/0x80 [ 831.931188][ T5774] ? kthread_blkcg+0xd0/0xd0 [ 831.935789][ T5774] ret_from_fork_asm+0x11/0x20 [ 831.940566][ T5774] [ 831.952874][ T5774] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 831.967289][ T5774] Bluetooth: hci1: failed to register connection device [ 832.389672][T14044] loop4: detected capacity change from 0 to 32768 [ 832.421219][T14044] (syz.4.2447,14044,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 832.586267][T14064] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2451'. [ 832.655494][T14061] 9pnet_fd: p9_fd_create_tcp (14061): problem connecting socket to 127.0.0.1 [ 833.055716][T14044] (syz.4.2447,14044,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 833.682076][T14044] JBD2: Ignoring recovery information on journal [ 833.732271][T14071] overlayfs: failed to resolve './file0': -2 [ 833.796901][T14044] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 833.852041][T14072] binder: 14068:14072 ioctl c0306201 0 returned -14 [ 834.020450][T11356] Bluetooth: hci1: command 0x0406 tx timeout [ 835.723128][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 835.733532][T11356] CPU: 0 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 835.741202][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 835.751284][T11356] Workqueue: hci3 hci_rx_work [ 835.756163][T11356] Call Trace: [ 835.759669][T11356] [ 835.762615][T11356] dump_stack_lvl+0x18c/0x250 [ 835.767317][T11356] ? show_regs_print_info+0x20/0x20 [ 835.772524][T11356] ? load_image+0x420/0x420 [ 835.777221][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 835.782340][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 835.787464][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 835.792265][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 835.798490][T11356] kobject_add_internal+0x617/0xc90 [ 835.803737][T11356] kobject_add+0x164/0x240 [ 835.808445][T11356] ? kobject_init+0x1d0/0x1d0 [ 835.813324][T11356] ? get_device_parent+0x366/0x390 [ 835.819069][T11356] device_add+0x3fa/0xc40 [ 835.823407][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 835.828450][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 835.833760][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 835.840025][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 835.845709][T11356] ? mutex_unlock+0x10/0x10 [ 835.850354][T11356] ? skb_pull_data+0xf0/0x1f0 [ 835.855050][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 835.860669][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 835.866846][T11356] hci_event_packet+0x7b4/0x1280 [ 835.871816][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 835.876868][T11356] ? lock_chain_count+0x20/0x20 [ 835.881722][T11356] ? bis_list+0x290/0x290 [ 835.886388][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 835.891627][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 835.896870][T11356] hci_rx_work+0x43a/0xd60 [ 835.901298][T11356] ? process_scheduled_works+0x975/0x1600 [ 835.907022][T11356] process_scheduled_works+0xa60/0x1600 [ 835.912598][T11356] ? worker_attach_to_pool+0x370/0x370 [ 835.918114][T11356] ? assign_work+0x3cc/0x5d0 [ 835.922733][T11356] worker_thread+0xa5e/0xfe0 [ 835.927352][T11356] ? _raw_spin_unlock+0x40/0x40 [ 835.932241][T11356] ? __kthread_parkme+0x71/0x1c0 [ 835.937217][T11356] kthread+0x2fa/0x390 [ 835.941305][T11356] ? pr_cont_work+0x550/0x550 [ 835.945999][T11356] ? kthread_blkcg+0xd0/0xd0 [ 835.950592][T11356] ret_from_fork+0x48/0x80 [ 835.955018][T11356] ? kthread_blkcg+0xd0/0xd0 [ 835.959622][T11356] ret_from_fork_asm+0x11/0x20 [ 835.964427][T11356] [ 836.065768][T11356] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 836.080562][T11356] Bluetooth: hci3: failed to register connection device [ 836.134566][T12922] ocfs2: Unmounting device (7,4) on (node local) [ 837.225136][T14094] 9pnet_fd: p9_fd_create_tcp (14094): problem connecting socket to 127.0.0.1 [ 838.190657][ T5774] Bluetooth: hci3: command tx timeout [ 840.233589][T14099] loop1: detected capacity change from 0 to 32768 [ 840.286147][T14099] (syz.1.2466,14099,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 840.357923][T14099] (syz.1.2466,14099,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 840.379476][ T28] audit: type=1800 audit(1786366268.450:132): pid=14119 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2474" name="zone_nr_conv" dev="configfs" ino=35699 res=0 errno=0 [ 840.570587][T14099] JBD2: Ignoring recovery information on journal [ 840.586131][T14124] 9pnet_fd: p9_fd_create_tcp (14124): problem connecting socket to 127.0.0.1 [ 841.582047][T14099] JBD2: journal reset failed [ 841.586751][T14099] (syz.1.2466,14099,1):ocfs2_journal_load:1168 ERROR: Failed to load journal! [ 841.600172][T14099] (syz.1.2466,14099,0):ocfs2_check_volume:2430 ERROR: ocfs2 journal load failed! -4 [ 841.665271][T14133] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2476'. [ 841.700049][ T5774] Bluetooth: hci4: command 0x0406 tx timeout [ 842.594471][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 842.604246][T11356] CPU: 0 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 842.611876][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 842.621924][T11356] Workqueue: hci3 hci_rx_work [ 842.626625][T11356] Call Trace: [ 842.630428][T11356] [ 842.633373][T11356] dump_stack_lvl+0x18c/0x250 [ 842.638093][T11356] ? show_regs_print_info+0x20/0x20 [ 842.643308][T11356] ? load_image+0x420/0x420 [ 842.647848][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 842.652961][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 842.658103][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 842.662803][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 842.668064][T11356] kobject_add_internal+0x617/0xc90 [ 842.673321][T11356] kobject_add+0x164/0x240 [ 842.677796][T11356] ? kobject_init+0x1d0/0x1d0 [ 842.682530][T11356] ? get_device_parent+0x366/0x390 [ 842.687708][T11356] device_add+0x3fa/0xc40 [ 842.692118][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 842.697084][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 842.702389][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 842.708632][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 842.714369][T11356] ? mutex_unlock+0x10/0x10 [ 842.718902][T11356] ? skb_pull_data+0xf0/0x1f0 [ 842.723607][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 842.729182][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 842.735265][T11356] hci_event_packet+0x7b4/0x1280 [ 842.740220][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 842.745250][T11356] ? lock_chain_count+0x20/0x20 [ 842.750102][T11356] ? bis_list+0x290/0x290 [ 842.754457][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 842.759662][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 842.764871][T11356] hci_rx_work+0x43a/0xd60 [ 842.769302][T11356] ? process_scheduled_works+0x975/0x1600 [ 842.775041][T11356] process_scheduled_works+0xa60/0x1600 [ 842.780625][T11356] ? worker_attach_to_pool+0x370/0x370 [ 842.786187][T11356] ? assign_work+0x3cc/0x5d0 [ 842.790814][T11356] worker_thread+0xa5e/0xfe0 [ 842.795424][T11356] ? _raw_spin_unlock+0x40/0x40 [ 842.800374][T11356] ? __kthread_parkme+0x71/0x1c0 [ 842.805412][T11356] kthread+0x2fa/0x390 [ 842.809483][T11356] ? pr_cont_work+0x550/0x550 [ 842.814168][T11356] ? kthread_blkcg+0xd0/0xd0 [ 842.818761][T11356] ret_from_fork+0x48/0x80 [ 842.823189][T11356] ? kthread_blkcg+0xd0/0xd0 [ 842.827783][T11356] ret_from_fork_asm+0x11/0x20 [ 842.832674][T11356] [ 843.745109][T11356] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 843.779969][T11356] Bluetooth: hci3: failed to register connection device [ 844.149986][ T789] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 845.011571][T14157] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2488'. [ 845.101250][ T789] usb 4-1: Using ep0 maxpacket: 8 [ 845.108211][ T789] usb 4-1: config 0 interface 0 has no altsetting 0 [ 845.115971][ T789] usb 4-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 845.143710][ T789] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 845.232016][ T789] usb 4-1: config 0 descriptor?? [ 845.270061][ T5804] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 845.818547][ T789] usbhid 4-1:0.0: can't add hid device: -71 [ 845.861071][T11356] Bluetooth: hci3: command tx timeout [ 845.900896][ T789] usbhid: probe of 4-1:0.0 failed with error -71 [ 845.978395][ T789] usb 4-1: USB disconnect, device number 30 [ 846.077751][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 846.087992][T11356] CPU: 1 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 846.095673][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 846.105764][T11356] Workqueue: hci0 hci_rx_work [ 846.110470][T11356] Call Trace: [ 846.113750][T11356] [ 846.116681][T11356] dump_stack_lvl+0x18c/0x250 [ 846.121384][T11356] ? show_regs_print_info+0x20/0x20 [ 846.126765][T11356] ? load_image+0x420/0x420 [ 846.131318][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 846.136439][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 846.141471][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 846.146176][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 846.151390][T11356] kobject_add_internal+0x617/0xc90 [ 846.151626][ T5804] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 846.156622][T11356] kobject_add+0x164/0x240 [ 846.171204][T11356] ? kobject_init+0x1d0/0x1d0 [ 846.175881][T11356] ? get_device_parent+0x366/0x390 [ 846.180998][T11356] device_add+0x3fa/0xc40 [ 846.185329][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 846.190376][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 846.195693][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 846.202055][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 846.207704][T11356] ? mutex_unlock+0x10/0x10 [ 846.212378][T11356] ? skb_pull_data+0xf0/0x1f0 [ 846.217115][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 846.222668][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 846.228754][T11356] hci_event_packet+0x7b4/0x1280 [ 846.233720][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 846.238806][T11356] ? lock_chain_count+0x20/0x20 [ 846.243682][T11356] ? bis_list+0x290/0x290 [ 846.248005][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 846.253221][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 846.258443][T11356] hci_rx_work+0x43a/0xd60 [ 846.262881][T11356] ? process_scheduled_works+0x975/0x1600 [ 846.268600][T11356] process_scheduled_works+0xa60/0x1600 [ 846.274199][T11356] ? worker_attach_to_pool+0x370/0x370 [ 846.279684][T11356] ? assign_work+0x3cc/0x5d0 [ 846.284294][T11356] worker_thread+0xa5e/0xfe0 [ 846.288892][T11356] ? _raw_spin_unlock+0x40/0x40 [ 846.293741][T11356] ? __kthread_parkme+0x71/0x1c0 [ 846.298674][T11356] kthread+0x2fa/0x390 [ 846.302734][T11356] ? pr_cont_work+0x550/0x550 [ 846.307405][T11356] ? kthread_blkcg+0xd0/0xd0 [ 846.311984][T11356] ret_from_fork+0x48/0x80 [ 846.316433][T11356] ? kthread_blkcg+0xd0/0xd0 [ 846.321037][T11356] ret_from_fork_asm+0x11/0x20 [ 846.325837][T11356] [ 846.332799][T11356] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 846.347008][T11356] Bluetooth: hci0: failed to register connection device [ 846.392487][ T5804] usb 3-1: config 0 has no interfaces? [ 846.416362][ T5804] usb 3-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 846.441650][ T5804] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.497796][T14159] loop1: detected capacity change from 0 to 32768 [ 846.511473][ T5804] usb 3-1: config 0 descriptor?? [ 846.520914][T14159] (syz.1.2489,14159,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 846.588853][T14159] (syz.1.2489,14159,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 846.746487][T14159] JBD2: Ignoring recovery information on journal [ 846.886393][T14159] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode. [ 847.842417][T14183] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2496'. [ 847.945671][ T5769] ocfs2: Unmounting device (7,1) on (node local) [ 848.090418][ T5781] usb 3-1: USB disconnect, device number 11 [ 848.141012][T14185] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2498'. [ 848.427737][T11356] Bluetooth: hci0: command 0x0406 tx timeout [ 851.654690][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 851.664386][T11356] CPU: 1 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 851.672024][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 851.682112][T11356] Workqueue: hci0 hci_rx_work [ 851.686954][T11356] Call Trace: [ 851.690256][T11356] [ 851.693188][T11356] dump_stack_lvl+0x18c/0x250 [ 851.697878][T11356] ? show_regs_print_info+0x20/0x20 [ 851.703076][T11356] ? load_image+0x420/0x420 [ 851.707583][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 851.712685][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 851.717699][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 851.722459][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 851.727660][T11356] kobject_add_internal+0x617/0xc90 [ 851.732868][T11356] kobject_add+0x164/0x240 [ 851.737311][T11356] ? kobject_init+0x1d0/0x1d0 [ 851.742000][T11356] ? get_device_parent+0x366/0x390 [ 851.747166][T11356] device_add+0x3fa/0xc40 [ 851.751512][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 851.756474][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 851.761759][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 851.768049][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 851.773717][T11356] ? mutex_unlock+0x10/0x10 [ 851.778230][T11356] ? skb_pull_data+0xf0/0x1f0 [ 851.782944][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 851.788549][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 851.794623][T11356] hci_event_packet+0x7b4/0x1280 [ 851.799571][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 851.804619][T11356] ? lock_chain_count+0x20/0x20 [ 851.809514][T11356] ? bis_list+0x290/0x290 [ 851.813851][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 851.819050][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 851.824255][T11356] hci_rx_work+0x43a/0xd60 [ 851.828675][T11356] ? process_scheduled_works+0x975/0x1600 [ 851.834413][T11356] process_scheduled_works+0xa60/0x1600 [ 851.839984][T11356] ? worker_attach_to_pool+0x370/0x370 [ 851.845484][T11356] ? assign_work+0x3cc/0x5d0 [ 851.850255][T11356] worker_thread+0xa5e/0xfe0 [ 851.855075][T11356] ? _raw_spin_unlock+0x40/0x40 [ 851.859941][T11356] ? __kthread_parkme+0x71/0x1c0 [ 851.864909][T11356] kthread+0x2fa/0x390 [ 851.869006][T11356] ? pr_cont_work+0x550/0x550 [ 851.873729][T11356] ? kthread_blkcg+0xd0/0xd0 [ 851.878331][T11356] ret_from_fork+0x48/0x80 [ 851.882759][T11356] ? kthread_blkcg+0xd0/0xd0 [ 851.887369][T11356] ret_from_fork_asm+0x11/0x20 [ 851.892168][T11356] [ 852.070422][T11356] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 852.094690][T11356] Bluetooth: hci0: failed to register connection device [ 852.257876][T14207] loop2: detected capacity change from 0 to 512 [ 852.333042][T14207] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 852.411321][T14207] ext4 filesystem being mounted at /70/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 852.660043][ T5835] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 852.732903][T14204] loop3: detected capacity change from 0 to 32768 [ 852.769330][T14204] (syz.3.2505,14204,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 852.807541][T14204] (syz.3.2505,14204,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 852.850759][T14219] block nbd4: Cannot use ioctl interface on a netlink controlled device. [ 852.854015][ T5835] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 852.872278][T14204] JBD2: Ignoring recovery information on journal [ 852.888693][ T5835] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 852.905289][ T5835] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 852.921489][ T5835] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 852.933810][ T5835] usb 2-1: config 0 descriptor?? [ 852.972685][T14204] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 853.175201][T14219] block nbd4: Cannot use ioctl interface on a netlink controlled device. [ 853.203873][T14219] block nbd4: shutting down sockets [ 853.227185][T13509] ocfs2: Unmounting device (7,3) on (node local) [ 854.180132][T11356] Bluetooth: hci0: command 0x0406 tx timeout [ 854.198972][T13177] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 856.072268][ T789] usb 2-1: USB disconnect, device number 28 [ 856.205227][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 856.217397][T11356] CPU: 0 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 856.225179][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 856.235283][T11356] Workqueue: hci0 hci_rx_work [ 856.240046][T11356] Call Trace: [ 856.243367][T11356] [ 856.246321][T11356] dump_stack_lvl+0x18c/0x250 [ 856.251028][T11356] ? show_regs_print_info+0x20/0x20 [ 856.256238][T11356] ? load_image+0x420/0x420 [ 856.260756][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 856.265901][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 856.270944][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 856.275635][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 856.280830][T11356] kobject_add_internal+0x617/0xc90 [ 856.286025][T11356] kobject_add+0x164/0x240 [ 856.290440][T11356] ? kobject_init+0x1d0/0x1d0 [ 856.295222][T11356] ? get_device_parent+0x366/0x390 [ 856.300333][T11356] device_add+0x3fa/0xc40 [ 856.304683][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 856.309659][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 856.314971][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 856.321246][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 856.326877][T11356] ? mutex_unlock+0x10/0x10 [ 856.331376][T11356] ? skb_pull_data+0xf0/0x1f0 [ 856.336064][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 856.341719][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 856.347825][T11356] hci_event_packet+0x7b4/0x1280 [ 856.352779][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 856.357998][T11356] ? lock_chain_count+0x20/0x20 [ 856.362851][T11356] ? bis_list+0x290/0x290 [ 856.367177][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 856.372372][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 856.377762][T11356] hci_rx_work+0x43a/0xd60 [ 856.382196][T11356] ? process_scheduled_works+0x975/0x1600 [ 856.388038][T11356] process_scheduled_works+0xa60/0x1600 [ 856.393613][T11356] ? worker_attach_to_pool+0x370/0x370 [ 856.399078][T11356] ? assign_work+0x3cc/0x5d0 [ 856.403688][T11356] worker_thread+0xa5e/0xfe0 [ 856.408319][T11356] ? _raw_spin_unlock+0x40/0x40 [ 856.413187][T11356] ? __kthread_parkme+0x71/0x1c0 [ 856.418122][T11356] kthread+0x2fa/0x390 [ 856.422184][T11356] ? pr_cont_work+0x550/0x550 [ 856.426966][T11356] ? kthread_blkcg+0xd0/0xd0 [ 856.431570][T11356] ret_from_fork+0x48/0x80 [ 856.436066][T11356] ? kthread_blkcg+0xd0/0xd0 [ 856.440659][T11356] ret_from_fork_asm+0x11/0x20 [ 856.445424][T11356] [ 856.452633][T11356] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 856.467307][T11356] Bluetooth: hci0: failed to register connection device [ 858.463587][T14259] loop2: detected capacity change from 0 to 32768 [ 858.486973][T14259] (syz.2.2518,14259,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 858.502679][T11356] Bluetooth: hci0: command 0x0406 tx timeout [ 858.509717][T14259] (syz.2.2518,14259,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 858.549219][T14259] JBD2: Ignoring recovery information on journal [ 858.670415][T10188] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 860.314778][T14259] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 860.490007][T10188] usb 4-1: Using ep0 maxpacket: 8 [ 860.541743][T10188] usb 4-1: config 0 interface 0 has no altsetting 0 [ 861.305551][T10188] usb 4-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 861.318956][T10188] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 861.330366][T10188] usb 4-1: config 0 descriptor?? [ 861.416671][T13177] ocfs2: Unmounting device (7,2) on (node local) [ 861.464771][T10188] usbhid 4-1:0.0: can't add hid device: -71 [ 861.480035][T10188] usbhid: probe of 4-1:0.0 failed with error -71 [ 861.492889][T10188] usb 4-1: USB disconnect, device number 31 [ 861.616765][T14287] loop4: detected capacity change from 0 to 512 [ 861.696741][T14287] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 861.987853][T14287] ext4 filesystem being mounted at /98/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 862.731695][T11356] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 862.741414][T11356] CPU: 0 PID: 11356 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 862.749074][T11356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 862.759132][T11356] Workqueue: hci4 hci_rx_work [ 862.763814][T11356] Call Trace: [ 862.767083][T11356] [ 862.770003][T11356] dump_stack_lvl+0x18c/0x250 [ 862.774674][T11356] ? show_regs_print_info+0x20/0x20 [ 862.779866][T11356] ? load_image+0x420/0x420 [ 862.784394][T11356] sysfs_create_dir_ns+0x26e/0x2a0 [ 862.789513][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 862.794536][T11356] ? sysfs_warn_dup+0xa0/0xa0 [ 862.799209][T11356] ? do_raw_spin_unlock+0x121/0x230 [ 862.804408][T11356] kobject_add_internal+0x617/0xc90 [ 862.809696][T11356] kobject_add+0x164/0x240 [ 862.814140][T11356] ? kobject_init+0x1d0/0x1d0 [ 862.818828][T11356] ? get_device_parent+0x366/0x390 [ 862.823963][T11356] device_add+0x3fa/0xc40 [ 862.828286][T11356] hci_conn_add_sysfs+0xd5/0x1e0 [ 862.833242][T11356] le_conn_complete_evt+0xe9f/0x1480 [ 862.838541][T11356] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 862.844804][T11356] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 862.850459][T11356] ? mutex_unlock+0x10/0x10 [ 862.854959][T11356] ? skb_pull_data+0xf0/0x1f0 [ 862.859647][T11356] hci_le_conn_complete_evt+0x187/0x440 [ 862.865295][T11356] ? hci_remote_host_features_evt+0x150/0x150 [ 862.871454][T11356] hci_event_packet+0x7b4/0x1280 [ 862.876678][T11356] ? __lock_acquire+0x7d80/0x7d80 [ 862.881704][T11356] ? lock_chain_count+0x20/0x20 [ 862.886547][T11356] ? bis_list+0x290/0x290 [ 862.890872][T11356] ? lockdep_hardirqs_on+0x98/0x150 [ 862.896078][T11356] ? hci_send_to_monitor+0xd7/0x4f0 [ 862.901639][T11356] hci_rx_work+0x43a/0xd60 [ 862.906092][T11356] ? process_scheduled_works+0x975/0x1600 [ 862.911821][T11356] process_scheduled_works+0xa60/0x1600 [ 862.917431][T11356] ? worker_attach_to_pool+0x370/0x370 [ 862.922926][T11356] ? assign_work+0x3cc/0x5d0 [ 862.927518][T11356] worker_thread+0xa5e/0xfe0 [ 862.932123][T11356] ? _raw_spin_unlock+0x40/0x40 [ 862.937003][T11356] ? __kthread_parkme+0x71/0x1c0 [ 862.941954][T11356] kthread+0x2fa/0x390 [ 862.946049][T11356] ? pr_cont_work+0x550/0x550 [ 862.950736][T11356] ? kthread_blkcg+0xd0/0xd0 [ 862.955413][T11356] ret_from_fork+0x48/0x80 [ 862.959826][T11356] ? kthread_blkcg+0xd0/0xd0 [ 862.964419][T11356] ret_from_fork_asm+0x11/0x20 [ 862.969233][T11356] [ 863.070636][T11356] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 863.084998][T11356] Bluetooth: hci4: failed to register connection device [ 863.633433][T14306] loop1: detected capacity change from 0 to 1024 [ 863.641051][T14306] EXT4-fs: Ignoring removed orlov option [ 863.789229][T14306] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 865.139981][ T5774] Bluetooth: hci4: command 0x0406 tx timeout [ 865.481459][T14306] jffs2: notice: (14306) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 865.579415][T12922] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 865.763231][T14318] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2532'. [ 867.050373][ T5781] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 867.310552][ T5781] usb 4-1: Using ep0 maxpacket: 8 [ 867.394648][ T5781] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 867.482325][ T5781] usb 4-1: config 0 has no interface number 0 [ 867.579199][ T5781] usb 4-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 867.697734][ T5781] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.814924][ T5781] usb 4-1: Product: syz [ 867.887362][ T5781] usb 4-1: Manufacturer: syz [ 867.952716][ T5781] usb 4-1: SerialNumber: syz [ 868.090786][ T5781] usb 4-1: config 0 descriptor?? [ 868.208967][T14320] loop4: detected capacity change from 0 to 32768 [ 868.225331][ T5781] usb 4-1: selecting invalid altsetting 2 [ 868.267598][ T5781] i2c-cp2615: probe of 4-1:0.1 failed with error -22 [ 869.031646][T14320] (syz.4.2535,14320,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 869.078889][T14306] syz.1.2533 (14306): drop_caches: 2 [ 869.188288][T14320] (syz.4.2535,14320,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 869.393579][T14320] workqueue: Failed to create a rescuer kthread for wq "ocfs2_wq": -EINTR [ 869.405036][T14320] (syz.4.2535,14320,1):ocfs2_initialize_super:2283 ERROR: status = -12 [ 869.688276][T14320] (syz.4.2535,14320,1):ocfs2_fill_super:1178 ERROR: status = -12 [ 869.787815][ T9] usb 4-1: USB disconnect, device number 32 [ 869.798296][ T5769] EXT4-fs warning (device loop1): empty_inline_dir:1864: bad inline directory (dir #12) - no `..' [ 870.343517][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.350054][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.361829][ T1293] aoe: packet could not be sent on ipvlan0. consider increasing tx_queue_len [ 874.200777][T11356] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 874.213731][T11356] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 874.223871][T11356] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 874.233776][T11356] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 874.254653][T10858] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 874.267880][T11356] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 874.275679][T11356] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 874.940191][ T5781] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 875.210114][ T5781] usb 3-1: Using ep0 maxpacket: 8 [ 875.247335][T14360] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2546'. [ 875.311293][ T5781] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 875.415576][ T5781] usb 3-1: config 0 has no interface number 0 [ 875.521074][ T5781] usb 3-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 875.654399][ T5781] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 875.774679][ T5781] usb 3-1: Product: syz [ 875.828744][ T5781] usb 3-1: Manufacturer: syz [ 875.892861][ T5781] usb 3-1: SerialNumber: syz [ 876.019505][ T5781] usb 3-1: config 0 descriptor?? [ 876.165473][ T5781] usb 3-1: selecting invalid altsetting 2 [ 876.263664][ T5781] i2c-cp2615: probe of 3-1:0.1 failed with error -22 [ 876.341619][T11356] Bluetooth: hci2: command tx timeout [ 877.710328][T14348] chnl_net:caif_netlink_parms(): no params data found [ 877.797540][ T5804] usb 3-1: USB disconnect, device number 12 [ 878.420157][T11356] Bluetooth: hci2: command tx timeout [ 879.100614][T14348] bridge0: port 1(bridge_slave_0) entered blocking state [ 879.620005][ T5781] page_pool_release_retry() stalled pool shutdown 1 inflight 788 sec [ 880.481046][T14348] bridge0: port 1(bridge_slave_0) entered disabled state [ 880.500253][T11356] Bluetooth: hci2: command tx timeout [ 880.570553][T14348] bridge_slave_0: entered allmulticast mode [ 880.624758][T14348] bridge_slave_0: entered promiscuous mode [ 880.645595][T14348] bridge0: port 2(bridge_slave_1) entered blocking state [ 882.484743][T14348] bridge0: port 2(bridge_slave_1) entered disabled state [ 882.529114][T14384] loop4: detected capacity change from 0 to 512 [ 882.560435][T14348] bridge_slave_1: entered allmulticast mode [ 882.577872][T14348] bridge_slave_1: entered promiscuous mode [ 882.587032][T11356] Bluetooth: hci2: command tx timeout [ 882.594432][T14384] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 882.722257][T14348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 882.749232][T14348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 884.758021][T14348] team0: Port device team_slave_0 added [ 885.185155][T14348] team0: Port device team_slave_1 added [ 885.696423][T14348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 885.721366][T14348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 885.800550][T14348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 885.824824][T12922] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 885.837743][T14348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 885.868142][T14348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 885.997392][T14348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 886.118387][T14348] hsr_slave_0: entered promiscuous mode [ 886.135045][T14348] hsr_slave_1: entered promiscuous mode [ 886.152242][T14348] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 886.180040][T14348] Cannot create hsr debugfs directory [ 886.537910][T14398] loop3: detected capacity change from 0 to 32768 [ 886.600696][T14398] (syz.3.2557,14398,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 886.661096][T14398] (syz.3.2557,14398,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 886.702239][T14408] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2558'. [ 887.081051][T14411] netlink: 'syz.2.2561': attribute type 10 has an invalid length. [ 887.362528][T14398] JBD2: Ignoring recovery information on journal [ 887.732034][T14411] veth1_macvtap: left promiscuous mode [ 887.741842][T14411] bond0: (slave macsec0): Error -34 calling dev_set_mtu [ 887.894275][T14398] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 889.025617][T13509] ocfs2: Unmounting device (7,3) on (node local) [ 889.926969][T14348] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 889.941514][T14348] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 889.956063][T14348] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 890.053542][T14348] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 890.286214][T14437] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2569'. [ 890.576156][T14348] 8021q: adding VLAN 0 to HW filter on device bond0 [ 890.914566][T14348] 8021q: adding VLAN 0 to HW filter on device team0 [ 890.932899][T13300] bridge0: port 1(bridge_slave_0) entered blocking state [ 890.940124][T13300] bridge0: port 1(bridge_slave_0) entered forwarding state [ 891.046431][T13300] bridge0: port 2(bridge_slave_1) entered blocking state [ 891.053613][T13300] bridge0: port 2(bridge_slave_1) entered forwarding state [ 892.308816][T14348] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 892.387631][T14348] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 894.191868][T14438] Bluetooth: hci3: command 0x0406 tx timeout [ 894.641382][T14348] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 894.742970][T14348] veth0_vlan: entered promiscuous mode [ 894.782343][T14348] veth1_vlan: entered promiscuous mode [ 894.807888][T14462] loop2: detected capacity change from 0 to 1764 [ 894.843966][T14446] loop3: detected capacity change from 0 to 32768 [ 894.869198][T14348] veth0_macvtap: entered promiscuous mode [ 894.882638][T14446] (syz.3.2573,14446,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 894.905093][T14348] veth1_macvtap: entered promiscuous mode [ 894.914262][T14446] (syz.3.2573,14446,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 894.981885][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.004467][T14466] comedi comedi3: No hardware detected at I/O base 0x3c4 [ 895.019102][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.036544][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.047578][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.060177][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.071324][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.081955][T14446] JBD2: Ignoring recovery information on journal [ 895.108808][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.132985][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.143161][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 895.155628][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.156879][T14446] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode. [ 895.176151][T14348] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 895.202446][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.246353][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.274901][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.310098][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.339036][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.350598][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.360708][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.371758][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.382277][T14348] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 895.393611][T14348] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 895.441630][T14348] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 896.413664][T13509] ocfs2: Unmounting device (7,3) on (node local) [ 896.423137][T14348] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.468113][T14348] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.500106][T14348] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.553539][T14348] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 896.983218][T14489] loop3: detected capacity change from 0 to 2048 [ 897.030548][T14489] NILFS (loop3): broken superblock, retrying with spare superblock (blocksize = 1024) [ 897.114521][T14492] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 897.125534][T14489] syz.3.2580: attempt to access beyond end of device [ 897.125534][T14489] loop3: rw=524288, sector=33554430, nr_sectors = 2 limit=2048 [ 898.922938][T14391] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 899.081400][T14391] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 899.469816][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 899.523200][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 902.970679][T14548] block nbd1: Cannot use ioctl interface on a netlink controlled device. [ 905.140691][T14548] block nbd1: Cannot use ioctl interface on a netlink controlled device. [ 905.431916][T14570] loop2: detected capacity change from 0 to 4096 [ 905.557604][T14570] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 906.851059][T13177] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 907.472057][T14595] loop2: detected capacity change from 0 to 2048 [ 907.496364][T14595] UDF-fs: error (device loop2): udf_read_tagged: tag version 0x0000 != 0x0002 || 0x0003, block 0 [ 907.507978][T14595] UDF-fs: warning (device loop2): udf_load_vrs: No anchor found [ 907.515908][T14595] UDF-fs: Scanning with blocksize 512 failed [ 907.542231][T14595] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 907.567440][T14567] loop4: detected capacity change from 0 to 32768 [ 907.610969][T14567] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 908.898932][T14617] netlink: 'syz.1.2613': attribute type 1 has an invalid length. [ 908.907778][T14617] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2613'. [ 909.056930][T12922] ocfs2: Unmounting device (7,4) on (node local) [ 909.187069][T14625] syz_tun: entered allmulticast mode [ 909.212566][T14608] block nbd2: shutting down sockets [ 909.219361][T14625] dvmrp8: entered allmulticast mode [ 909.280659][T14624] syz_tun: left allmulticast mode [ 910.565147][T14639] [ 910.567529][T14639] ====================================================== [ 910.574549][T14639] WARNING: possible circular locking dependency detected [ 910.581956][T14639] syzkaller #0 Not tainted [ 910.586362][T14639] ------------------------------------------------------ [ 910.593364][T14639] syz.4.2619/14639 is trying to acquire lock: [ 910.599430][T14639] ffffffff8ddf69d0 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: uvcg_streaming_header_allow_link+0x71/0x4a0 [ 910.610763][T14639] [ 910.610763][T14639] but task is already holding lock: [ 910.618116][T14639] ffff888079450b80 (&sb->s_type->i_mutex_key#22){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 910.628542][T14639] [ 910.628542][T14639] which lock already depends on the new lock. [ 910.628542][T14639] [ 910.639095][T14639] [ 910.639095][T14639] the existing dependency chain (in reverse order) is: [ 910.648172][T14639] [ 910.648172][T14639] -> #2 (&sb->s_type->i_mutex_key#22){++++}-{3:3}: [ 910.656861][T14639] down_write+0x97/0x200 [ 910.661652][T14639] configfs_depend_item_unlocked+0x157/0x430 [ 910.668154][T14639] usbg_make_tpg+0x1f7/0x580 [ 910.673355][T14639] target_fabric_make_tpg+0xa4/0x6d0 [ 910.679195][T14639] configfs_mkdir+0x515/0x9e0 [ 910.684417][T14639] vfs_mkdir+0x2a5/0x470 [ 910.689234][T14639] do_mkdirat+0x1dc/0x450 [ 910.694111][T14639] __x64_sys_mkdir+0x6e/0x80 [ 910.699221][T14639] do_syscall_64+0x55/0xb0 [ 910.704157][T14639] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 910.710652][T14639] [ 910.710652][T14639] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 910.718460][T14639] __mutex_lock+0x135/0xc80 [ 910.723651][T14639] tcm_set_name+0x2a/0x90 [ 910.728534][T14639] function_make+0x199/0x350 [ 910.733678][T14639] configfs_mkdir+0x515/0x9e0 [ 910.738874][T14639] vfs_mkdir+0x2a5/0x470 [ 910.743655][T14639] do_mkdirat+0x1dc/0x450 [ 910.748498][T14639] __x64_sys_mkdir+0x6e/0x80 [ 910.753625][T14639] do_syscall_64+0x55/0xb0 [ 910.758577][T14639] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 910.765011][T14639] [ 910.765011][T14639] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 910.773279][T14639] __lock_acquire+0x37ef/0x7d80 [ 910.778658][T14639] lock_acquire+0x19e/0x420 [ 910.783676][T14639] __mutex_lock+0x135/0xc80 [ 910.788694][T14639] uvcg_streaming_header_allow_link+0x71/0x4a0 [ 910.795412][T14639] configfs_symlink+0x5a5/0xfe0 [ 910.800798][T14639] vfs_symlink+0x138/0x2b0 [ 910.805732][T14639] do_symlinkat+0x1ba/0x400 [ 910.810760][T14639] __x64_sys_symlink+0x7e/0x90 [ 910.816191][T14639] do_syscall_64+0x55/0xb0 [ 910.821215][T14639] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 910.827626][T14639] [ 910.827626][T14639] other info that might help us debug this: [ 910.827626][T14639] [ 910.837874][T14639] Chain exists of: [ 910.837874][T14639] gadget_subsys.su_mutex --> &opts->dep_lock --> &sb->s_type->i_mutex_key#22 [ 910.837874][T14639] [ 910.852597][T14639] Possible unsafe locking scenario: [ 910.852597][T14639] [ 910.860052][T14639] CPU0 CPU1 [ 910.865421][T14639] ---- ---- [ 910.870830][T14639] lock(&sb->s_type->i_mutex_key#22); [ 910.876380][T14639] lock(&opts->dep_lock); [ 910.883306][T14639] lock(&sb->s_type->i_mutex_key#22); [ 910.891285][T14639] lock(gadget_subsys.su_mutex); [ 910.896310][T14639] [ 910.896310][T14639] *** DEADLOCK *** [ 910.896310][T14639] [ 910.904457][T14639] 2 locks held by syz.4.2619/14639: [ 910.909649][T14639] #0: ffff88823bcda418 (sb_writers#16){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 910.918875][T14639] #1: ffff888079450b80 (&sb->s_type->i_mutex_key#22){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 910.929664][T14639] [ 910.929664][T14639] stack backtrace: [ 910.935543][T14639] CPU: 1 PID: 14639 Comm: syz.4.2619 Not tainted syzkaller #0 [ 910.942989][T14639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 910.953073][T14639] Call Trace: [ 910.956611][T14639] [ 910.959727][T14639] dump_stack_lvl+0x18c/0x250 [ 910.964403][T14639] ? load_image+0x420/0x420 [ 910.968898][T14639] ? show_regs_print_info+0x20/0x20 [ 910.974101][T14639] ? print_circular_bug+0x12b/0x1a0 [ 910.979290][T14639] check_noncircular+0x2fc/0x400 [ 910.984242][T14639] ? print_deadlock_bug+0x5d0/0x5d0 [ 910.989452][T14639] ? lockdep_lock+0xf5/0x230 [ 910.994052][T14639] ? _find_first_zero_bit+0xd6/0x100 [ 910.999399][T14639] __lock_acquire+0x37ef/0x7d80 [ 911.004341][T14639] ? __lock_acquire+0x1336/0x7d80 [ 911.009365][T14639] ? verify_lock_unused+0x140/0x140 [ 911.014601][T14639] lock_acquire+0x19e/0x420 [ 911.019122][T14639] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 911.025450][T14639] ? __might_sleep+0xe0/0xe0 [ 911.030038][T14639] ? read_lock_is_recursive+0x20/0x20 [ 911.035421][T14639] __mutex_lock+0x135/0xc80 [ 911.039920][T14639] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 911.046263][T14639] ? __might_sleep+0xe0/0xe0 [ 911.050852][T14639] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 911.057203][T14639] ? read_lock_is_recursive+0x20/0x20 [ 911.062569][T14639] ? mutex_lock_nested+0x20/0x20 [ 911.067505][T14639] ? configfs_symlink+0x469/0xfe0 [ 911.072522][T14639] ? make_vfsuid+0x67/0xb0 [ 911.076950][T14639] ? generic_permission+0x1ed/0x590 [ 911.082142][T14639] uvcg_streaming_header_allow_link+0x71/0x4a0 [ 911.088288][T14639] ? inode_permission+0xf3/0x480 [ 911.093222][T14639] ? bpf_lsm_inode_permission+0x9/0x10 [ 911.098723][T14639] ? security_inode_permission+0xb0/0xf0 [ 911.104365][T14639] configfs_symlink+0x5a5/0xfe0 [ 911.109390][T14639] ? from_kgid+0x153/0x6a0 [ 911.113799][T14639] ? generic_permission+0x1ed/0x590 [ 911.118992][T14639] ? detach_groups+0x370/0x370 [ 911.123749][T14639] ? inode_permission+0xf3/0x480 [ 911.128772][T14639] ? bpf_lsm_inode_symlink+0x9/0x10 [ 911.133960][T14639] ? security_inode_symlink+0xb6/0x100 [ 911.139412][T14639] vfs_symlink+0x138/0x2b0 [ 911.143834][T14639] do_symlinkat+0x1ba/0x400 [ 911.148342][T14639] ? vfs_symlink+0x2b0/0x2b0 [ 911.153014][T14639] ? getname_flags+0x20a/0x500 [ 911.157798][T14639] __x64_sys_symlink+0x7e/0x90 [ 911.162664][T14639] do_syscall_64+0x55/0xb0 [ 911.167072][T14639] ? clear_bhb_loop+0x40/0x90 [ 911.171743][T14639] ? clear_bhb_loop+0x40/0x90 [ 911.176411][T14639] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 911.182343][T14639] RIP: 0033:0x7fd8c619e0d9 [ 911.186749][T14639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 911.206541][T14639] RSP: 002b:00007fd8c43f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 911.214949][T14639] RAX: ffffffffffffffda RBX: 00007fd8c6425fa0 RCX: 00007fd8c619e0d9 [ 911.223078][T14639] RDX: 0000000000000000 RSI: 0000200000000880 RDI: 0000200000000800 [ 911.231048][T14639] RBP: 00007fd8c6235024 R08: 0000000000000000 R09: 0000000000000000 [ 911.239094][T14639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 911.247163][T14639] R13: 00007fd8c6426038 R14: 00007fd8c6425fa0 R15: 00007ffd0bd578c8 [ 911.255141][T14639]